authorization Shipped
What this lens looks for
Enforce all access control server-side — server-side authorization is the only real authorization, and client-side checks like hiding buttons or disabling fields are UX conveniences, never security controls. Deny by default: if no explicit permission grants access the request must be denied, and every new endpoint starts locked down. Apply least privilege: endpoints request the minimum scopes and each endpoint enforces its own permission check. Use RBAC with roles defined from minimal permissions, preferring fine-grained permissions composed into roles over monolithic role checks. Guard against Broken Object Level Authorization (BOLA), the #1 API security risk in the OWASP API Top 10: the server must verify the authenticated user actually has access to the specific resource ID requested, and must never assume that knowing the ID implies access.
What its verifier checks
All access control is enforced server-side, with no authorization gate that exists only client-side; access is denied by default, and any endpoint without an explicit grant rejects the request; every endpoint performs its own permission check and requests only the minimum scopes needed; roles are composed from fine-grained, least-privilege permissions rather than monolithic role checks; every object/resource access verifies the authenticated user owns or is entitled to that specific resource ID (no resource returned on ID alone).