Every authorization check must be specific to the HTTP method and the path being called. These are four different functions that may have four different authorization requirements:

• GET /api/posts/123 — read a post (permitted: all authenticated users)

• PUT /api/posts/123 — edit a post (permitted: the post’s author only)

• DELETE /api/posts/123 — delete a post (permitted: admin role only)

• PATCH /api/posts/123 — partially update a post (permitted: author or moderator)

The authorization check must match the specific method being used, not just the path.

Define permissions as (role, method, path_pattern) tuples. Your authorization middleware compares the incoming request’s method and path against this table. An admin role with GET /api/admin/users doesn’t automatically grant access to DELETE /api/admin/users — that requires a separate permission entry.

API gateways (Kong, AWS API Gateway, Apigee) support method-level authorization natively. Define authorization policies per route — and a route is always a method + path pair, never just a path. Enforcing at the gateway means the check runs before the request reaches application code.