12 lines
579 B
Markdown
12 lines
579 B
Markdown
# Permission Module — Manual Review Checklist
|
|
|
|
High-risk module: authorization changes require product/human confirmation.
|
|
|
|
- [ ] Every endpoint/action enforces the intended permission — no default-allow
|
|
- [ ] Role hierarchy / scoping (tenant, org, user) is consistent
|
|
- [ ] Object-level permissions checked on read AND write
|
|
- [ ] Deny-before-allow ordering is safe
|
|
- [ ] Permission checks cannot be bypassed via IDs, query params, or bulk ops
|
|
- [ ] New permission/role values handled by all consumers (enum completeness)
|
|
- [ ] Sensitive actions audited with actor + target
|