The Series· No. 38 · Act IX — The Foundation

By DocuSeller · Published

Security
DocuSeller · No. 38

The word you can't forget

The worst bug we could ever ship isn't the site going down.

It's one company seeing another company's data.

And a bug like that is never dramatic. It's one missing word.

Four service counters show three access locks and one conspicuous missing check One forgotten check is enough1234Per-screen checks can be missed
Two hundred of these. One with no lock on it, and nobody knows which.

Every admin screen asks the same question. Show me the orders. Show me the owners.

And every one of them needs the same clause bolted on the end: ...that belong to this person's company.

The old way is to leave that to whoever built the screen. Two hundred screens. One developer having a bad Tuesday.

So we took it off the screens entirely.

Every request now passes through one gate before it ever reaches the data. The gate narrows it to the companies and communities that person is allowed to see. Screens can't forget, because screens were never asked.

Wide going in. Narrow coming out. The screens don't get a vote.
All requests narrow through a single allowed-scope gate before returning authorized records Every request passes through the scope gateAllowed scopeAuthorizedrecords onlyAll records
Every request passes through one scope gate. Only authorized records come out.

And the gate fails shut.

A closed tap above an empty bucket illustrates returning zero rows when access scope cannot be resolved Unknown scope: no records?0 rowsThe gate fails closed
Confused, and so it gives you nothing. Plenty of taps do the opposite.

If it can't work out what you're allowed to see, the answer is zero rows. Never everything.

That direction matters more than it sounds. Plenty of systems, when confused, open.

Underneath the gate: about 120 separate permissions.

Not "admin or not admin". Individual keys. View orders. Issue a refund. Approve a document.

A permission board supplies a role with separate keys for viewing orders, refunds, and document approvals A role is a set of permissionsView ordersIssue refundsApprove docs
About 120 hooks on that board. A role is just the bunch we hand you.

They come pre-bunched into roles that ship with the platform — company admin, billing admin, community manager. Companies can cut their own on top, invisible to everyone outside.

Then people get scoped: this person, these companies, these communities. Or unrestricted, if that's genuinely the job.

One more, and it's small, and it matters. An invitation carries the invited email locked into it.

It can't be walked to another desk and redeemed by somebody else.

An invitation addressed to an example email can be redeemed by that email and not a different one An invitation belongs to its email addresssam@example.comInvited emailMatching emailCan redeemDifferent emailCannot redeem
An invitation you can't hand to the person at the next desk.

And everything after that gets written down. Who changed what, and when, and a log per person. Deeply boring, right up until the day it isn't.

Security you have to remember to apply is security you will eventually forget.

Next: the parts of the platform nobody notices, right up until the second they stop.

#SaaS · #PropTech · #HOA