Where should authorization checks live in an application?

Summary

Enforce authorization on the server, as close to the data and business logic as practical, through a central policy layer that every entry point (HTTP, GraphQL resolvers, jobs, admin tools) calls. UI checks only improve the experience; they never protect data.

Longer Answer

Typical layering: the route/middleware checks authentication and coarse permissions; the service/use-case layer checks resource-level permissions with a policy function (can(user, 'refund', order)); the data layer scopes queries by tenant. Avoid scattering if user.role == 'admin' across the codebase.

Key Points

• Server-side, near the data
• Central policy functions
• Cover every entry point
• UI checks are cosmetic