backend-authorization

Backend Authorization

Purpose

Design and implement authorization that is correct, auditable, and maintainable. Every protected resource must have an explicit access decision. Authorization rules live in code or policy, never in the developer's head.

Architecture Decision Trees

Authorization Model Selection

How many resource types need access control?
├── < 10 → Flat RBAC (simple role-permission map)
└── >= 10 → Do roles map well to resources?
    ├── Yes → Does every user fit a single role?
    │   ├── Yes → Hierarchical RBAC (roles + inheritance)
    │   └── No → RBAC + ABAC hybrid (roles for coarse, attributes for exceptions)
    └── No → Does access depend on relationships between entities?
        ├── Yes → ReBAC (Zanzibar-style relationship tuples)
        └── No → ABAC (attribute-based policies for maximal flexibility)

Regulatory requirements (SoD, audit)?
├── Yes → Constrained RBAC with SoD enforcement
└── No → Standard RBAC or ABAC

Multi-tenant?
├── Yes → RBAC + scope-based authorization (org/department/team isolation)
└── No → Single-tenant RBAC or ABAC

Policy Engine Decision Tree

Existing policy engine in stack?
├── Yes → Leverage existing engine
└── No → Cloud-native / K8s?
    ├── Yes → OPA (sidecar deployment, Rego policies, K8s admission control)
    └── No → Need GUI for non-devs to manage policies?
        ├── Yes → Permit.io (SaaS, visual policy editor)
        └── No → Multi-language support critical?
            ├── Yes → Casbin (libraries for 10+ languages, in-app)
            └── No → Fine-grained, human-readable policies?
                ├── Yes → Cerbos (YAML policies, sidecar)
                └── No → ReBAC at massive scale?
                    └── AuthZed / SpiceDB (Zanzibar, gRPC API)

Temporary Access Decision Tree

Emergency scenario (production outage)?
├── Yes → Break-glass protocol: MFA required, 30 min expiry, security team notified
└── No → Need temporary elevated permissions?
    ├── Yes → JIT elevation: request + approval, time-bound, auto-expire
    └── No → Need to delegate permissions?
        └── Delegation: delegator-scoped, time-bound, non-cascading