1 min lesson
RBAC and authorization modeling
Walk through each part of "RBAC and authorization modeling", then explain what each one does.
Step 1 of 3
Authentication proves who is calling. Authorization decides what they're allowed to do. The JD's auth ownership is mostly the second one and it's where B2B dev-tool design gets genuinely hard.
Keep the two layers clean. The access token tells you the principal; a separate, centralized authorization decision tells you whether that principal may read this repo or invite that member. Bleeding authz logic into every service is how a flat org ends up with seven inconsistent permission checks and a security incident.