Authorization logic copied into every handler is authorization logic that will be missed somewhere. Instead, implement authorization in a single, centralized location that runs consistently on every request:

• Middleware: Authorization middleware that runs before every request handler. Reads the route + method + token, looks up the permission, and either passes or blocks.

• API Gateway policies: Authorization rules defined at the gateway layer — before requests reach any application code.

• Policy engine: A dedicated authorization service (like OPA — Open Policy Agent) that answers “is this token permitted to call this action?” from any service in a microservices architecture.

If each handler contains its own role check (if user.role != ‘admin’: return 403), every new endpoint must add it explicitly. When a developer forgets — even once — the endpoint ships without authorization. Centralized enforcement means the check runs automatically without depending on the developer’s memory.

GraphQL APIs are particularly at risk because each resolver is a separate function with its own authorization logic. Without a centralized authorization layer that validates every resolver call, resolvers are easy to miss. The GitLab breach was a GraphQL resolver with no authentication requirement — it was never added because no centralized layer enforced it.