17 patterns · 49 working examples
Support acting on a customer's behalf isn't a permission upgrade — it needs its own paper trail, or you either over-grant forever or block legitimate help.
17 patterns · 49 working examples
These aren't chapter titles — each one is an enforced rule your AI builds against. And the patterns don't just teach the shape: the working examples are real code that lands in your project.
Sorting every user into one of three privacy tiers, driven by data not code
Collapsing every auth check into a small, auditable set of database helpers
Resolving which account a user belongs to when they're not staff
Tracking signed-in devices without a self-lockout on 'sign out everywhere'
Making sure logout actually revokes the login, not just the local session
Letting one person sign in with Google or GitHub without duplicate accounts
Avoiding the infinite redirect loop a naive onboarding route creates
The full login-to-tenant-resolution path, and the naming it locks in
Letting one user access another tenant's data without changing their role
Wiring enterprise single sign-on without hand-rolled SAML plumbing
Answering 'who changed this' for any table, without a bespoke log each time
Automating data retention, scheduled purge, and right-to-erasure requests
Giving one tenant type a second reader persona without a second schema
A safe, greppable way to write server code that bypasses row security
The two functions every row-security policy in the app must call
The handful of row-security shapes that cover almost every table
Untangling what row security should check versus what's just a UI permission
The exact class of bug behind real, named incidents — a support person either can't do their job, or can see everything.