Skip to main content

​
Authentication and Authorization Model

​
Audience

This page is for platform security designers, backend implementers, CLI/Agent integrators, and operators who need to understand production guardrails.

​
Goal and Scope

This page defines the roles of AuthN, AuthZ, and Approval, the shared execution chain, and why production mutations require step-up and approval.

​
Core Concepts

​
AuthN

AuthN handles identity validation, session/token management, and principal derivation.

​
AuthZ

AuthZ evaluates action/resource/environment context and returns allow / deny / require_approval.

​
Approval

Approval records, validates, and audits high-risk production authorizations.

​
Standard Workflow

AuthN -> AuthZ -> Approval(if required) -> Execute -> Audit

​
CLI Examples

aios approval request \
  --action deploy.app.update \
  --resource app:project/prod/my-api

​
Web UI Path

  • login and identity context
  • production approval flow
  • authorization failure and approval-required prompts

​
Pitfalls / Risk Notes

  • Better Auth does not replace business authorization.
  • long-lived JWTs must not carry mutable authorization state.
  • any prod write path that bypasses approval is an architectural violation.