Search docs
Docs searchValidation category
Authorization
Review implemented validation rules for missing, inconsistent, or misplaced authorization enforcement.
Why it matters
Authorization findings highlight places where protected Cloud workflows need clear server-side access-control evidence.
What this category covers
- Protected operations with visible authorization checks.
- Consistent enforcement across related resource operations.
- Authorization logic placed at reusable request or service boundaries.
Implemented rules
These are the currently implemented rules in this category. Cloud stores and displays the uploaded findings from local validation; it does not add future or speculative rules.
| Rule ID | Rule title | Category | Severity | Short explanation | Example violation | Remediation guidance |
|---|---|---|---|---|---|---|
| AP-AUTH-001 | Missing authorization enforcement | Authorization | warning | Flags protected operations without clear authorization enforcement evidence. | PATCH /organizations/:id/policy-config updates policy after only checking that a user is signed in. | Add the expected role, permission, or organization access check. Use the local authorization helper used by adjacent endpoints. Add tests for allowed and forbidden callers. |
| AP-AUTH-002 | Inconsistent authorization within resource | Authorization | warning | Flags resource endpoints that enforce authorization inconsistently across operations. | Deleting a token requires admin access, but creating a token only requires membership. | Compare authorization across all operations for the resource. Standardize on the intended helper or guard. Document intentional differences and cover them with tests. |
| AP-AUTH-003 | Authorization logic placed in wrong layer | Authorization | warning | Flags authorization logic placed in a layer that makes enforcement hard to reuse or audit. | A repository checks whether the current user is an admin before returning rows. | Move authorization to the request guard, policy service, or application service boundary. Keep persistence methods free of caller-role decisions. Retain UI gating only as presentation feedback, not enforcement. |
Related pages
Next steps