Concepts
Authorization Enforcement
Authorization rules are enforced by the platform at the data layer, not recreated independently in each handler and client.
Policies defined in Inspire apply to:
- queries
- mutations
- routes
- includes
- live queries
Why This Matters
In many systems, authorization is a pattern developers are expected to remember. In Kizaki, it is supposed to be part of the application model itself.
That changes the failure mode. A missing permission check is no longer just an application bug in one handler. The goal is to make the data layer itself enforce the rule.
What Developers Should Take Away
- policies belong with entities
- workflow-specific admission checks belong at the function or route boundary
- frontend code should not be the place where access decisions are invented
This is why Kizaki docs recommend putting rules in the schema and keeping frontend and handler code focused on workflow.