ENGINEERING NOTE / 07
Authentication and authorization boundaries
A signed-in user is not automatically allowed to see every record. I design authorization around the resource being requested and the action being performed.
In this note 05 questions
What is the difference between authentication and authorization?
Authentication establishes who is making a request. Authorization determines whether that identity may perform a particular action on a particular resource. Both checks belong on the server.
When are roles useful?
Roles express broad responsibilities, such as Doctor, Editor, and Patient in the clinic platform. They provide a starting point, but a role alone cannot answer whether a user may read a specific patient's data.
How do you protect an individual record?
Load the record within the caller's permitted scope or explicitly verify ownership or membership before returning it. In Pulse, conversation membership is checked before private attachments are served.
Why validate every request?
A hidden button and a private URL are interface choices, not permission checks. Every endpoint that reads or changes sensitive data must enforce the rule again, including file downloads and background actions.
What should tests prove?
Test allowed access, denied access, and attempts to use another user's resource identifier. A failing authorization test should reveal a real data boundary, not merely a missing UI element.