skills.rest
pnewsam
pnewsamCOMMUNITY
Explore all skills by this author →
Website𝕏@paultakumaGitHub

backend-auth-boundaries

Guides placement of backend authentication and authorization checks for identity, permissions, and tenant isolation.

1|Updated Apr 15, 2026
Search Tags:#authorization#authentication#owasp#access control#permissions#tenant isolation#backend security
One-click install
npx skills add https://github.com/pnewsam/skills --skill backend-auth-boundaries-pnewsam
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: backend-auth-boundaries
Source: https://github.com/pnewsam/skills/tree/main/archive/backend-evicted/backend-auth-boundaries
Command: npx skills add https://github.com/pnewsam/skills --skill backend-auth-boundaries-pnewsam

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Backend code often scatters or misplaces authorization logic, relying on UI guards, role-only checks, or unfiltered queries that leak data across tenants and users. This Skill provides a decision framework for placing authentication and authorization correctly at server-side boundaries. ## Core Features & Use Cases - Decision Rubric: Maps concerns like authentication, authorization, identity context, object access, sessions, and service-to-service calls to preferred guidance. - Guardrails and Checklists: Supplies a permission-matrix approach, do/don't tables, and a review checklist covering cross-tenant, expired-token, and privilege-change cases. - Use Case: When building a multi-tenant API endpoint that lists customer records, use this Skill to ensure queries filter by tenant, direct object lookups are guarded, and failures return non-revealing errors. ## Quick Start Review my backend endpoint for authorization gaps and tell me where identity and permission checks should be placed.

Frequently Asked Questions about backend-auth-boundaries

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement authorization in a backend API?▼

Authorize every protected action at the backend boundary by checking action, resource, tenant or owner, and relevant state, not just role. Use named policy helpers for repeated decisions and fail closed with non-revealing errors.

What is object-level authorization and why does it matter?▼

Object-level authorization verifies the caller can access each specific record, not just the endpoint. Hidden or unguessable IDs are not authorization; guard list, detail, mutation, export, and job paths individually.

How do I enforce tenant isolation in database queries?▼

Filter by tenant or ownership directly in the query so unauthorized records never leave storage, then still guard direct object lookup paths. Avoid fetching broad data and filtering in memory after permission checks.

Should I pass JWTs through my backend service layers?▼

No. Authenticate once at a trusted entrypoint, then pass a minimal identity context containing subject ID, tenant, roles, and claims through domain code. Raw tokens should not travel through many layers.

What authorization test cases should backend code cover?▼

Test forbidden access, cross-tenant attempts, unauthenticated requests, expired sessions, and privilege changes, not only the admin success path. Also verify errors do not reveal whether hidden objects exist.

Related Skills

Explore More Software Engineering Skills→
machenjiemachenjie
4

user-role-identification

Identify actors and authorization-relevant properties for proposed changes.

Community
Advanced
ashtonianashtonian
2

data-model

Design multi-tenant database schemas with migrations and Go/TypeScript repositories.

Community
Advanced
MovchanetsMovchanets

auth-implementation-patterns

Design secure authentication and authorization systems for APIs and microservices.

Community
Advanced
MrJmpl3MrJmpl3

0065-laravel-policies-and-authorization

Centralize Laravel access control using Policies and Gates.

Community
Basic