Joining a workspace or tenant often unlocks a long list of APIs. That membership proves the caller belongs in the org. It does not prove they may delete this project, export that dataset, or rotate someone else's key.
A common bug: if (user.tenantId === resource.tenantId) allow. Same tenant is a necessary scope check, not an authorization decision.
Authorize the specific action on the specific resource. Membership answers "are they in this org?" Permission answers "may they do this to that object?" Keep those questions separate.
Top comments (0)