# Permission Module — Manual Review Checklist

High-risk module: authorization changes require product/human confirmation.

- [ ] Every endpoint/action enforces the intended permission — no default-allow
- [ ] Role hierarchy / scoping (tenant, org, user) is consistent
- [ ] Object-level permissions checked on read AND write
- [ ] Deny-before-allow ordering is safe
- [ ] Permission checks cannot be bypassed via IDs, query params, or bulk ops
- [ ] New permission/role values handled by all consumers (enum completeness)
- [ ] Sensitive actions audited with actor + target