Scopes, claims, and authorization design
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
design fine-grained authorization.
Planned topics
- Scopes describe what a client may do (
orders:read,inventory:write); claims describe who the user is (subject, roles, tenant). - Authorization has layers: scope (may this client call this API?), role (may this user do this kind of action?), and ownership or attribute checks (is this their order?).
- Keep tokens small; put stable facts in claims, look up changing permissions in the service.
- Least privilege: admin operations need their own scope.
- Test authorization as code (negative tests).
Draft outline details
Demonstration
matrix: endpoint | scope | role | ownership check.
Check your understanding
Which check stops customer A reading customer B's order?
Show answer
The ownership check.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.