Roles and permissions

🏠The everyday picture

In a hospital, nurses can read charts, doctors can write prescriptions, pharmacists can dispense, and the accounts office sees bills but not diagnoses. Each role gets what its job needs.

📘What it really is

Role-based access control (RBAC): users get roles (admin, manager, staff, viewer); roles get permissions (customers:read, customers:delete, reports:export).
Check permissions on the server, every time (Module 50). Hiding a button in the frontend isn't security: anyone can call the API directly.
Object-level checks: not only "can staff read customers?" but "can this user read this customer?" (for example, only customers in their branch). Missing object checks are the most common serious API flaw, called Broken Object Level Authorisation or IDOR: changing /customers/41 to /customers/42 shows someone else's data.
Deny by default: a new route is closed until a permission is explicitly granted. A central middleware (requirePermission("customers:delete")) makes this consistent.
Sensitive actions (deleting, exporting all data, changing roles) deserve extra checks: re-entering the password or MFA, and an audit log entry (Module 56).
Database row-level security (Module 61) is a second layer behind the app's checks.
Test authorisation with automated tests: for each important route, one user who should succeed and one who must be refused.

🖱️Try it

Make a permissions table for your CRM: rows are roles, columns are actions, cells yes or no. Then test it: log in as a viewer and try, with curl or the browser's network tools, to delete a customer, change your own role, and read a customer from another branch by changing the ID. Write an automated test for each refusal. Fix any that succeed.

✅Quick check

Is hiding the "Delete" button from staff enough to stop them deleting?

Show the answer

No. The server must check the permission on every request, because the API can be called directly.

What's an IDOR vulnerability?

Show the answer

Being able to reach another user's data simply by changing an ID in the request, because the server doesn't check ownership.