Scopes and Attribute-Based Authorization
OAuth scopes provide coarse-grained permissions such as orders:read or orders:write.
Attribute-Based Access Control can evaluate attributes of the user, resource, action, and environment. For example: allow update when user.organizationId === resource.organizationId and resource.status !== 'locked'.
In complex systems, authorization becomes a policy decision rather than a simple role comparison.
Key Takeaways
- Authentication alone is never sufficient for resource access.
- Scopes are useful for API-level permissions.
- Resource-level checks prevent BOLA/IDOR vulnerabilities.
- Complex systems may require policy-based authorization.