← All explorersRoles and permissions →
Authorization Flow
The default-deny decision, in order: sign-in, the study, the license for the feature, membership, the permission on the grants the record is about, the workspace and the study's state, before any data is touched.
Driven by real source:
server/src/api/middleware/authorize.ts · rbac domainAuthorization is default-deny: a request is refused unless every layer allows it. The layers run in a fixed order and the layer that stops a request gives the refusal, so a person who is not allowed never learns the state of a study.
RequestGuardsOutcome