Tech World Software SchoolTWSS
0x20Lesson 3 of 6

Design authorization policies

Use least privilege, roles, attributes, and explicit deny-by-default decisions.

12 min 5-question quiz
By the end of this lesson you can
  • Compare RBAC and ABAC and make authorization checks specific to actions and resources.

Role-based access control (RBAC) assigns permissions to roles and identities to roles. Attribute-based access control (ABAC) evaluates attributes about the identity, resource, action, and context. Both can be useful, and systems often combine policy approaches. Start with least privilege, deny by default, and check access at the service that owns the resource rather than trusting a user interface to enforce it.

Authorization policy should be understandable, testable, and applied consistently. Check the requested action against the specific resource and current identity context. Avoid overbroad wildcard grants, stale role membership, and relying on client-supplied attributes without verification.

Practice: write a least-privilege policy

Try it

Up to 15 XP

Make access exactly right

Each round starts with a broad rule that works, and that’s the problem. Turn rules on and off until every request gets the right answer.

Two things to remember: anything no rule allows is denied by default, and an explicit deny always beats an allow.

Round 1 of 2: Roles in a reporting app

Analysts read reports, editors read and change them, and only admins delete them.

Your policy

Requests

  • An analyst reads a reportAllowed (should be allowed)Decided by: Anyone can do anything
  • An analyst edits a reportAllowed (should be denied)Decided by: Anyone can do anything
  • An editor reads a reportAllowed (should be allowed)Decided by: Anyone can do anything
  • An editor edits a reportAllowed (should be allowed)Decided by: Anyone can do anything
  • An editor deletes a reportAllowed (should be denied)Decided by: Anyone can do anything
  • An admin deletes a reportAllowed (should be allowed)Decided by: Anyone can do anything
  • An intern reads a reportAllowed (should be denied)Decided by: Anyone can do anything
3 requests get the wrong decision.

Key takeaways

  • Compare RBAC and ABAC and make authorization checks specific to actions and resources.

  • Treat access as a lifecycle: grant deliberately, review regularly, and revoke promptly.

Lesson quiz

5 questions · pass with 4 correct · up to 50 XP

Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.

Questions about this lesson

Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.

Loading posts…