Building apps
What is authorization?
Authorization is the process of deciding what an authenticated user is allowed to do: which records they can see, which actions they can take, and which parts of an application they can reach.
New to Bolt? Sign up free.
Technical definition
Authorization determines the permissions of a verified identity. The common models:
- Role-based access control: permissions attached to roles, and roles assigned to users
- Attribute-based access control: permissions evaluated from attributes of the user, the resource, and the context
- Row-level security: rules enforced by the database, so a query returns only rows the user may see
Authorization must be enforced server-side or at the data layer. A permission check performed in the browser can be bypassed by the user, since they control that environment.
In plain terms
Authentication is who you are. Authorization is what you are allowed to touch.
A staff member and a customer both log in to the same app. One should see every booking; the other should see only their own. That difference is authorization.
Why it matters
This is the most common serious security flaw in small business software, and it is invisible until it is not.
The failure looks like this: the app has a working login, and the interface shows each customer their own records. But the underlying request asks for a record by its ID, and nothing checks whether the person asking owns it. Change the number in the request and you get someone else's data. Nobody notices until someone does.
Hiding a button is not authorization. Filtering a list in the interface is not authorization. The rule has to live where the data is, so that the wrong request returns nothing rather than returning the record.
The test is straightforward: log in as one ordinary user and try to reach another user's data directly. If you can, so can anyone.
