Module 02
Permissions & Organizations
Move from 'is this person logged in' to 'may THIS person do THIS to THIS object' - and then to products where the object belongs to a team, and the team belongs to a customer.
5 lessons · 15 videos · 7h 7m
- 02.01
Authentication Is Not Authorization
Place RBAC, ABAC and ReBAC on one axis and pick the simplest of the three that can express your product's rules.
- 02.02
The IDOR in Your API
Find the endpoints in your own codebase that fetch an object by id without checking who owns it, and say why a generated CRUD layer produces this by default.
- 02.03
Fine-Grained Authorization & ReBAC
Model a Drive-style sharing rule as relationships rather than roles, and say what a Zanzibar-derived system buys you over a permissions column.
- 02.04
Teams, Organizations & Multi-Tenancy
Choose between silo, pool and bridge tenant isolation for a SaaS product, and name what leaks first when you get it wrong.
- 02.05
Invitations, SCIM & Enterprise Lifecycle
Explain why an enterprise customer will not accept 'invite your colleagues by email', and what SSO plus SCIM actually provision and deprovision.