What is Authorization?

Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.

Where Authorization goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 4 minutes · Pro
Permission denied for table
Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.
Why does Supabase say permission denied for table?
The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.
Read the fix
Who may see what · 4 minutes · Pro
Day 31: permission denied
Your app worked for a month. Today every read fails with 'permission denied'. Your AI has a one-line fix ready.
Why does Firebase deny access after 30 days?
Test-mode rules allow anyone to read and write until a date, then expire. When they expire, every request is denied. Do not replace them with 'if true', which opens the database permanently. Write rules that let users access only their own documents, checked against request.auth.uid.
Read the fix
AI inside your app · 4 minutes · Pro
The assistant that cancelled everything
Your booking app's AI assistant can cancel bookings. A user typed 'cancel all the bookings for Friday'. It cancelled 63, most of them other people's.
How do I give an AI assistant safe tools?
Run every tool with the permissions of the signed-in user, not an admin key, and take the user's id from their session rather than from the model. Then the model can only do what the user could already do. For actions that delete or change a lot, show what will happen and ask the user to confirm first.
Read the fix
Who may see what · 4 minutes · Free
Invoice 105
Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
What is an IDOR vulnerability?
An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.
Walk it, free
Who may see what · 4 minutes · Pro
The redirect that let them in
Your middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.
Is middleware enough to protect my pages?
No. Middleware is a useful place for redirects, but it is a single layer, and framework bugs have allowed requests to skip it. Check authorization again wherever data is read: in server pages, route handlers and database rules. Keep your framework patched.
Read the fix
AI inside your app · 4 minutes · Pro
The chatbot that shared its instructions
A user posted a screenshot of your support bot's hidden instructions, including the staff-only discount code and an API key.
Can users see my chatbot's system prompt?
Assume yes. A system prompt is text in the same conversation as the user's messages, and models can be talked into repeating it. The prompt text itself is rarely the danger; secrets and rules inside it are. Keep API keys in server environment variables and enforce permissions in code, so a leaked prompt reveals nothing useful.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Policy: One rule in Row Level Security, such as 'people can read only their own orders'.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

All 62 terms in the glossary

Where Authorization goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 4 minutes · Pro

Permission denied for table

Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Why does Supabase say permission denied for table?

The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.

Read the fix

Who may see what · 4 minutes · Pro

Day 31: permission denied

Your app worked for a month. Today every read fails with 'permission denied'. Your AI has a one-line fix ready.

Why does Firebase deny access after 30 days?

Test-mode rules allow anyone to read and write until a date, then expire. When they expire, every request is denied. Do not replace them with 'if true', which opens the database permanently. Write rules that let users access only their own documents, checked against request.auth.uid.

Read the fix

AI inside your app · 4 minutes · Pro

The assistant that cancelled everything

Your booking app's AI assistant can cancel bookings. A user typed 'cancel all the bookings for Friday'. It cancelled 63, most of them other people's.

How do I give an AI assistant safe tools?

Run every tool with the permissions of the signed-in user, not an admin key, and take the user's id from their session rather than from the model. Then the model can only do what the user could already do. For actions that delete or change a lot, show what will happen and ask the user to confirm first.

Read the fix

Who may see what · 4 minutes · Free

Invoice 105

Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.

What is an IDOR vulnerability?

An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.

Walk it, free

Who may see what · 4 minutes · Pro

The redirect that let them in

Your middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.

Is middleware enough to protect my pages?

No. Middleware is a useful place for redirects, but it is a single layer, and framework bugs have allowed requests to skip it. Check authorization again wherever data is read: in server pages, route handlers and database rules. Keep your framework patched.

Read the fix

AI inside your app · 4 minutes · Pro

The chatbot that shared its instructions

A user posted a screenshot of your support bot's hidden instructions, including the staff-only discount code and an API key.

Can users see my chatbot's system prompt?

Assume yes. A system prompt is text in the same conversation as the user's messages, and models can be talked into repeating it. The prompt text itself is rarely the danger; secrets and rules inside it are. Keep API keys in server environment variables and enforce permissions in code, so a leaked prompt reveals nothing useful.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Policy

One rule in Row Level Security, such as 'people can read only their own orders'.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.