Reading-path month: January 2026. Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.
Authorization: turn business rules into testable decisions
A user role alone does not explain resource access.
Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.
Reading context
A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.
Original source ↗The architecture decision
'Managers may approve' sounds simple until branches, limits and temporary replacements appear. The design must preserve those conditions across service calls.
Practical application
Editorial proposal: describe each decision using subject, action, object and context. For a hypothetical approval, record whether the limit belongs to the individual or business unit. Avoid distributing interpretation across UI, API and database.
How to verify
Ask business owners for nearly identical allowed and forbidden examples. Changing only the branch or amount exposes ambiguity. Acceptance criteria should explain why the decision changed, providing a practical basis for future rule maintenance.