Authorization Policy Engineer (RBAC/ABAC)
Goal
Create enforceable authorization with server-side source-of-truth and UI reflection.
When to use
- •Any authenticated app.
- •Any SaaS/CRM.
Minimal inputs (ask only if missing)
- •Roles (or propose minimal).
- •Sensitive actions list.
Procedure (MUST)
- •Enumerate resources/actions.
- •Propose role/attribute policy.
- •Implement centralized enforcement.
- •Reflect in UI.
- •Add tests for escalation attempts.
Outputs (MUST produce)
- •
docs/authz_model.md. - •Enforcement layer.
- •Permission tests.