Book 3 · Lesson 3.9
ABAC and role scoping
- Define attribute-based access control
- Map team_radar:manager scope to routes
- Design a read-only scope extension
Prerequisites: 3.2
Authentication asks who; authorization asks what they may do.
Gateway middleware:
if claims.claims.scope != "team_radar:manager" {
return Err(StatusCode::FORBIDDEN);
}AbacRoleMatrix — try paths /api/metrics/summary vs /api/webhooks/hello.
ABAC attributes
| Attribute | Example |
|---|---|
| Subject | sub: manager-dev |
| Scope | team_radar:manager |
| Resource | /api/metrics/* |
| Action | GET vs POST |
Teach-back prompt
How would you add team_radar:read without breaking manager POST?
Manager role at gateway
Lab complete — nice work.