auditing-declarative-authorization

# Auditing declarative authorization: coverage and correctness are two audits Modern authorization is often declarative: a policy attached to a table, a filter registered on a controller, a rule in a gateway or serverless config. The strength of that model is also its weakness, security depends on the rule being attached to every path that needs it, and on the rule actually expressing the intended constraint. The failures are gaps (a route the filter never covers) and mis-statements (a rule that checks the wrong thing), and both are invisible if you only read the routes that are protected. ## When to use - You are reviewing role- or policy-driven access control. - Authorization is enforced by row-level policies, controller filters, middleware, or gateway rules. - Protection depends on a rule being attached per route, per table, or per resource. ## Scope check Audit access control in systems you own or are authorized to test, with test accounts across roles and tenants. If you can't name the authorization, stop. ## The loop 1. **Locate every declared rule and its scope.** Inventory the authorization rules: row-level policies, controller filters, middleware, gateway or serverless access rules, and ownership checks. For each, determine exactly which paths, tables, or resources it covers. The audit is about coverage and correctness, so start by mapping what each rule protects. 2. **Find the paths the rule does not cover.** Enumerate every route, query, or ...