Permissions belong in the service layer

Separate identity from permission

Authentication establishes who is making a request. Authorization decides whether that identity may perform a particular action on a particular resource. A signed-in user does not automatically have access to every record.

Enforce access at the boundary

Hiding a button improves the interface, but does not enforce a security policy. OWASP recommends denying access by default and validating permissions on every request. Apply the decision in trusted server code.

Include the resource context

A role can be a starting point. Ownership, organizational boundaries and relationships may also matter. For a hypothetical approval workflow, being an approver should not imply permission to approve every organization's records.

Review more than the happy path

Use a small permission matrix to review allowed and denied actions. Include:

• Direct requests for another user's record identifier.
• Exports and background operations.
• Access after a role changes.
• The same action reached through different modules.