skill-auth-rbac

You can implement RBAC in Express using middleware that intercepts requests and validates permissions against database-backed policy rules. This skill provides middleware patterns to enforce granular action-resource scopes and role hierarchies.

JWT-embedded authorization keeps tokens lean by storing only roles in the token while resolving actual permissions server-side against the database. This approach prevents token bloat and allows permission updates without reissuing JWTs.

Database-backed permission modeling requires defining roles, permissions, and resource scopes in your database with corresponding migrations. This skill provides clear policy patterns and migration structures to establish the schema needed for server-side permission resolution.

Scalable authorization is supported through hierarchical role inheritance, database-backed permission resolution, and policy-based guards that standardize access decisions. This architecture handles growing user bases and complex permission trees without hardcoded checks.