MFA makes authentication stronger. It does not decide what the authenticated caller may do.
A user who passed a second factor is still only identified. They may still lack permission for that document, tenant, or admin action. Treating "MFA complete" as "allowed" skips the real check.
Authorize on the server for every sensitive request: subject, action, and the specific resource. Keep MFA in the identity path — not as a substitute for permissions.
Top comments (0)