Skip to content

ADR 0012: Policy-Based Authorization

Decision

BooksPlus should use policy-based authorization rather than relying only on broad roles or hard-coded administrator checks.

Roles may exist as convenient bundles of permissions, but protected application behavior should be governed by named policies.

Rationale

Accounting systems require control over specific actions. "Admin" is too broad to express the difference between setup authority, posting authority, close authority, review authority, backup authority, and technical administration.

BooksPlus should authorize protected verbs explicitly.

Examples:

  • AccountingEntry.Post
  • AccountingEntry.Reverse
  • Period.Close
  • Period.Reopen
  • ChartOfAccounts.Change
  • User.Manage
  • Backup.Export
  • Backup.Restore
  • AuditLog.View
  • SupportAccess.Grant

This supports the BooksPlus design preference for nouns and verbs, testable contracts, and explicit audit evidence.

Implications

Business logic should not rely on checks such as:

if user is admin

Instead, business logic should require named authorization policies.

Roles should be treated as permission bundles, not as permanent shortcuts around policy enforcement.

Guidance

For MVP:

  • define a small set of standard roles;
  • define protected actions as named policies;
  • require authorization at service boundaries;
  • log denied sensitive actions when useful for audit and troubleshooting;
  • keep accounting authority separate from sysadmin authority.