B1What the client asks
“Can different people see different things?”
Roles, then permissions, then per-record ownership. It is always one layer deeper than the first conversation suggests.
What actually goes wrong
The first answer is roles: an admin and a user. The second is permissions, because an editor may publish but not delete. The third is ownership, because a salesperson may read accounts, but only theirs.
The third layer is the one that is missed, and it is the one that becomes an incident: changing a number in a URL and seeing somebody else’s invoice.
What Grit does about it
- Roles and permissions are in the project before you start, with the sidebar, the forms and the seeded permissions all knowing about a new role.
- Per-record ownership is a flag on the resource. Queries are scoped by the actor in the context, so the rule holds for the API, an export, an import and a job.
- A record you may not see answers 404 rather than 403, so IDs cannot be enumerated.
The commands
A new role, everywhere it has to be known
grit add role MANAGER
Rows belong to the user who created them
grit generate resource Note --owned-by user --fields "title:string, body:text"
Or to an organisation
grit generate resource Invoice --tenant-owned --fields "number:string, total:money"
What it does not do
Permission design is yours. That a regional manager sees their region, and what happens when somebody changes region, is domain modelling that nothing generates.