Topic cluster
Authorization and access control
Determining which users may view change or administer resources and operations.
View topic page3 items
The remaining keywords do not make a useful further split. All matching documentation is listed below.
Keep permission checks at the boundary
Use the request context when checking access to data and actions. A hidden button is not an authorization check: callers can invoke a model or endpoint directly.
Test and publish access rules
Check a rule change before it affects everyone.
Test with different users
Choose roles that exercise the operation's permission boundary: anonymous visitor, limited editor, and administrator. Use separate browser sessions or an explicit test context for each role.