BUILD OS · REUSABLE RULE
Authentication is not authorization
Rule
A valid session identifies a caller. Each protected resource still needs an explicit ownership, role or tenant decision.
Why it matters
A user can be correctly signed in and still request another user’s resource through a changed identifier or direct endpoint call.
Failure mode
The interface hides a record, but the API or database returns it when a caller requests its identifier directly.
Implementation
- Derive the caller from a verified server session.
- Enforce ownership in server queries and database policies.
- Keep privileged service credentials server-only.
- Default-deny admin and cross-tenant access.
Verification
- Use two accounts and attempt cross-account reads, writes and deletes.
- Repeat signed out and with an expired session.
- Inspect the deployed RLS policy state, not only migration files.
Evidence and provenance
DocumentéThe Atamatax case and a published field note document account-scoped case data and the corresponding access-review rule.
Source updated 2026-09-26: published field note.