# Authorization: turn business rules into testable decisions

https://thiago.limaesilvatecnologia.com.br/en/artigos/authorization-decisions/

Published: 2026-09-12

A user role alone does not explain resource access.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: January 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

'Managers may approve' sounds simple until branches, limits and temporary replacements appear. The design must preserve those conditions across service calls.

## Practical application

Editorial proposal: describe each decision using subject, action, object and context. For a hypothetical approval, record whether the limit belongs to the individual or business unit. Avoid distributing interpretation across UI, API and database.

## How to verify

Ask business owners for nearly identical allowed and forbidden examples. Changing only the branch or amount exposes ambiguity. Acceptance criteria should explain why the decision changed, providing a practical basis for future rule maintenance.

## Sources

- [OWASP — Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)