Create and maintain a permissions matrix that maps every API function to the roles permitted to call it. This document (or configuration file) is both the source of truth for authorization and an auditable record of decisions made.
Format it as a table: rows are functions (method + path), columns are roles. Each cell is PERMIT or DENY:
| Function | guest | user | premium | admin |
|---|---|---|---|---|
| GET /api/posts/{id} | ✓ | ✓ | ✓ | ✓ |
| GET /api/premium/matches | ✗ | ✗ | ✓ | ✓ |
| DELETE /api/posts/{id} | ✗ | ✗ | ✗ | ✓ |
| GET /api/admin/users | ✗ | ✗ | ✗ | ✓ |
The matrix should live in version control alongside the code — ideally as a config file that the authorization middleware reads directly. This makes authorization auditable in code review: when a new endpoint is added, the PR must also update the permissions matrix, making gaps visible.
Ask for a list of all admin or elevated-privilege API endpoints — then ask when each one was last reviewed to confirm its access control is correct and being enforced.