Identity and authorization

Enforce access where the protected action happens

Hiding another user’s Edit button does not stop a direct HTTP request. A saved URL can also cause the server to connect somewhere the user could not reach directly. Follow both the person’s permission and the service’s network privileges.

Begin with ownership checks in a local API, then extend to tenant boundaries, private links, and outbound fetches. Keep demonstration identity headers separate from production authentication. State the protected resource and action before selecting an AWS permission.