Should a new public API version reuse existing OAuth clients and grants?
Reuse OAuth clients and grants across API versions only when the authorization contract stays materially the same and old approvals do not expand access.
EXPLORE THE FOUNDATIONS
Authorization.
Permissions, policies, and deciding who can do what.
Authorize Bulk APIs Without Leaks or Partial Corruption
Choose atomic, filtered, or per-item authorization semantics for bulk reads, writes, exports, and imports without weakening single-object access checks.
Make Organization Switching an Authorization Boundary
Keep tenant context explicit per request so tabs, tokens, background work, and audit trails cannot cross organization boundaries.
Escape role explosion in B2B SaaS authorization
Keep roles small and stable, move exceptions into permissions and scoped relationships, and plan migration, testing, and admin UX before custom roles.
How should permissions change when a record moves from draft to finalized?
A record moving from draft to finalized should not trigger a wholesale rewrite of permissions.
What should happen to permissions when two customer records are merged?
When two customer records are merged, permissions should not be blindly unioned or intersected.
What should a publish action check when a page embeds private attachments?
A publish action should authorize the page and every embedded dependency before public release.
Support impersonation that preserves accountability
Design short-lived support access that keeps operator and customer identities separate, denies sensitive actions, supports revocation, and leaves useful audit trails.
Reauthorize background jobs when permissions change mid-run
Choose snapshot, continuous, or delegated authority per side effect, then define cancellation and audit behavior before a long-running job starts.
Make access reviews explainable and actionable
Turn raw permissions into grants with source, scope, owner, use, expiry, and removal impact so reviewers can make safe decisions.
Should an agent see tools it is not authorized to execute?
Permission-filter tool discovery when tool names, schemas, or descriptions reveal sensitive operations, and enforce authorization again on every tool call.
Treat Sharing Links as Bearer Capabilities
Design sharing URLs as revocable, scoped credentials with explicit expiry, audience, and leakage controls.
Recalculate authorization when resources move
How to authorize resource moves safely: check source and destination permissions, preview inherited-access changes, and update parent and permissions consistently.
Who may configure a webhook that sends project data to an external endpoint?
Only a principal with explicit authority to disclose the selected data externally and bind it to the destination endpoint should configure that webhook.
Give tenant admins control without platform privileges
Design tenant admin roles that stay inside one tenant, limit delegation paths, and keep platform-level authority in a separate control plane.
Who should be allowed to view a dashboard built from several private datasets?
Decide whether dashboard access should inherit from each source dataset or from a separately approved derived output with its own policy.
How do I prevent an invoice author from approving their own invoice?
Model approval as two checks: the actor must be an approver, and the actor must not be the author of the invoice revision being approved.
What permissions are required to create a resource inside someone else's project?
Check create permission on the parent project first, then enforce strict rules for the new child’s initial owner, collaborators, and inherited access.
Should first-party and third-party apps follow the same authorization rules?
Use one OAuth platform and one security baseline, but classify your own app and external apps into different trust levels for approval, scopes, consent, and revocation.
Prevent Privilege Escalation in SaaS Invite Flows
Prevent invite-based privilege escalation by binding each invite to tenant, recipient, role ceiling, expiry, single-use state, and current delegation authority at acceptance.
How should a PATCH endpoint enforce different permissions for individual fields?
Treat PATCH as a set of explicit writes, authorize each requested field mutation, and fail closed on unknown or forbidden paths to prevent mass assignment.
Garbage-collect relationship tuples without resurrecting access
Use immutable IDs, tombstones, ordered cleanup, and restore rules so deleted principals and resources cannot regain stale permissions.
Should duplicating a project copy its members and sharing permissions?
Treat a duplicate as a new resource with a deliberate initial access policy.
When a customer duplicates an automation, should its credentials and permissions be copied?
Recommended clone semantics for automations: copy logic, require explicit rebinding of credentials and grants, and treat connection reuse as a separate authorization step.
Can a tool response tell an AI agent which identity to use for its next call?
Tool output should never pick the principal for the next API call.
Give an AI Agent a Smaller Access Contract Than Its Human Operator
Do not hand an AI agent your user session. Exchange it for a smaller, task-specific grant bounded by resource, action, purpose, time, spend, and delegation.
Design Delegation Boundaries with OAuth Token Exchange
Give each downstream service a narrow token by separating subject, actor, audience, scope, lifetime, and audit context.