11-authorization

Centralize authorization logic with guards, middleware, and service-layer ownership checks.

Updated Mar 9, 2026

Search Tags:#authorization #ownership #middleware #rbac #policy #guards #service-layer

Ready to run

npx skills add https://github.com/kennypallchizaca-coder/agentic-full-stack-skills --skill 11-authorization

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: 11-authorization
Source: https://github.com/kennypallchizaca-coder/agentic-full-stack-skills/tree/main/skills-backend/11-authorization
Command: npx skills add https://github.com/kennypallchizaca-coder/agentic-full-stack-skills --skill 11-authorization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enforces authorization with guards, policy checks and ownership válidation so authenticated users can only perform allowed actions.

Core Features & Use Cases

Centralized authorization logic via guards, decorators, middleware, or policy helpers.
Service-layer ownership checks with project-defined privileged overrides when applicable.
Deterministic 401/403/404 flows and safe denials with audit logging.

Quick Start

Start by authenticating the user, then apply policy checks, and finally validate resource ownership in the service layer before performing any protected operation.

Frequently Asked Questions about 11-authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enforce RBAC policy and ownership checks in my backend service layer?▼

Enforce RBAC policy and ownership checks by centralizing authorization logic in the service layer using guards and middleware. This ensures authenticated principals only perform permitted actions before any protected operation executes.

What is the best way to handle 401, 403, and 404 error flows for protected routes?▼

Handle 401, 403, and 404 error flows deterministically by applying centralized policy checks and safe denials. This guarantees authenticated users lacking permissions receive correct 403 responses while missing resources return 404.

How do I apply privileged overrides for specific users during authorization?▼

Apply privileged overrides during authorization by configuring project-defined policy exceptions within the service layer. This allows specific authenticated principals to bypass standard ownership checks when permitted by custom rules.

Can I use guards and decorators to centralize authorization logic across protected routes?▼

You can use guards and decorators to centralize authorization logic across protected routes. This approach applies consistent policy checks and audit logging before reaching service-layer ownership validations.

Why does my authorization middleware return 403 instead of 404 for resources a user does not own?▼

Authorization middleware returns 403 instead of 404 when policy checks prioritize permission denial over resource existence. Deterministic error flows ensure safe denials prevent leaking whether unowned resources actually exist.

Do I need to authenticate users before applying policy checks and ownership validation?▼

You need to authenticate users before applying policy checks and ownership validation. Authorization logic requires an authenticated principal to evaluate permitted actions and enforce service-layer ownership rules correctly.