Authorization · Access control
Roles, claims, RBAC and ABAC
Roles and claims differ; translate complex permissions into policies.
Understand the concept
A role is a category assigned to a user; a claim is a verified statement about a subject. Department, tenant and authentication context are not automatically roles. A role=Admin field supplied in a request body is not a trusted claim. RBAC ties permissions to roles and is understandable, but many special cases can cause role explosion.
ABAC combines subject and resource attributes with context. Approving an open expense in one’s own tenant is more specific than merely being an administrator. Policies make such rules central and testable. Keep claim types, mappings and role names consistent with the identity provider.
Token-carried permissions have freshness and size trade-offs. Choose expiry, server lookup or cache invalidation according to the system. Understand the framework’s requirement and handler composition, and regression-test existing endpoints when adding roles. RBAC and ABAC can be combined.
When scaling business roles and resource policies.
Treating every claim as a role or a body-supplied role as verified identity.
One topic. Three levels of depth.
Role: Editor
Claim: tenant_id=acmeCategory and tenancy information serve different purposes.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
Does an Editor role permit updates across every tenant?
Show the solution and explanation
Not unless the explicit resource policy grants that scope.No. A role does not automatically remove tenant boundaries.