Authorization and Role-Based Access Controls
Learn about authorization and role-based access controls in our Rails application.
We'll cover the following...
In most organizations, the authentication mechanism is driven by product and business concerns, and the decision around what method to use is typically easy to make. Authorization—the mapping of what users can perform what actions—is often much more complicated.
If we are building software to be used by employees of the company or a software-as-a-service product intended for knowledge workers, there will often be a myriad of features available, some of which control highly sensitive or potentially dangerous functions.
For example, we might have a feature to grant credit to users, allowing them to purchase products without using their own money. We may not want anyone at the company to be able to grant this credit.
What makes authorization ...