Why this matters
Prevents drift and subtle authorization bugs.
Provide a single permission check API (e.g., can(user, action, resource)) and reuse it across layers.
Prevents drift and subtle authorization bugs.
Side-by-side examples engineers can pattern-match during review.
if (user.role == "admin") { /*...*/ } // scatteredif (!authz.can(user, Action.Edit, doc)) return forbidden()role checks inlineauthz.can(user, Action.Delete, obj)From the same buckets as this rule.