Writing
2026
Authorization in four questionsCapability, partition, relationship and tenant. Each question with its own mechanism, and no role trying to answer all of them.- Cached permissions go stale in three waysUser version, catalog version and the clock. None of them can depend on a cron job.
- Who can give power to whomUsing a capability and granting it are different authorities. Model both.
- The prompt is not a security boundaryWhen an LLM writes the query, authorizing who asks isn't enough. What matters is what the answer can touch.
- A log is not one thingOperations, grants and access differ in volume, retention and criticality. And not every audit failure should have the same consequence.
- A foreign key doesn't guarantee the tenantA foreign key proves both rows exist. It doesn't prove they belong to the same customer.
- Mask before you call the LLMSwapping an ID for a placeholder is the start. The hard parts are the reverse map, the detector, the quasi-identifiers and the answer that comes back with the wrong placeholder.
- AI amplifies execution, not judgmentThe bottleneck moved from implementing to reviewing.
- ReBAC and RBAC: when to use eachRoles for what is broad, relationships for what is per resource.
- V60 without the fussRatio, grind and one variable at a time.