Skip to main content
Batoi RAD Docs

Identity and Authorization

Apply authenticated identity, role, workspace, and object-level controls consistently.

Version 1.x Active framework documentation Reviewed Jul 21, 2026 Next review Oct 21, 2026
Start Reading Open Batoi RAD GitHub Report documentation issue

Owner: Batoi Engineering Reviewed by: Batoi RAD Maintainers Source revision: bb9902c

Browse Batoi RAD Documentation Identity and Authorization
On this page

Identity and Authorization

Authentication establishes who is present. Authorization decides whether that identity may perform a specific action on a specific resource in the current scope.

Required Checks

  • Confirm the session is valid before loading private content.
  • Resolve the active platform or workspace context on the server.
  • Enforce the permitted role or capability for each action.
  • Check ownership or membership before reading or mutating an object.
  • Recheck authorization for downloads, exports, background operations, and APIs.

UI affordances can explain permissions, but they are not security controls. A direct request must receive the same decision as a button-driven request.

For sensitive changes, preserve enough evidence to identify the actor, operation, target, outcome, and time without logging secrets or unnecessary personal data.