Who can do what, decided where.
Authorization: RBAC and ABAC: who can do what, decided where
design for the day something breaks
RBAC is simple but coarse.
RBAC assigns roles to users and permissions to roles. ABAC evaluates attributes (user, resource, action, env) against policies. Real apps mix both, often with policy engines (OPA, Casbin).
Centralized engines simplify audit but add latency.
Embed checks at the data layer to prevent IDOR (insecure direct object reference).
Always authorize on server — never trust client claims.
Multi-tenant SaaS access checks.