Authorization
What are you allowed to do? Ownership checks, RBAC, ABAC and policy, broken access control, tenant isolation, and where enforcement must live.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Ownership checks, roles, permissions, attribute policies, scopes and tenant isolation are different tools for the same question — and most real systems need three of them at once, layered in a specific order.
Users get roles, roles get permissions — simple to reason about, easy to audit, and prone to a predictable failure when the role set grows to match every feature.
Decide by evaluating a rule over the requester's attributes, the resource's attributes, the action and the environment — expressive where roles are not, and dangerous when the rules become unreadable.
`GET /invoices/100` works; `GET /invoices/101` also works and it is not yours. Authentication succeeded, authorization was never asked — the most common serious vulnerability in web applications and APIs.
A `tenant_id` column is not isolation. Isolation is that column enforced consistently across queries, caches, queues, storage, search, logs and AI context — every place a copy of the data exists.
Not in the frontend, not only at the gateway, and not as an optional call in each handler — but at the point where the resource is loaded, structured so it cannot be skipped.