Authorization

Authorization interviews decide what authenticated actors may do—through RBAC, ABAC, ACLs, policy engines, tenant isolation, and least-privilege service boundaries.

Subtopics: RBAC, ABAC, and ACL models, and policy-based multi-tenant authorization.

On interviews: given a multi-tenant API, explain where you check roles vs attributes vs per-resource grants, and how you prevent cross-tenant data leaks.

Common pitfalls: checking roles only in the gateway, missing object-level checks, and policy engines without tests on tenant boundaries.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Pick access models that match domain shape.
• Enforce authorization near the protected resource.
• Scope queries and caches by tenant identity.
• Test denial paths and escalation scenarios.