How do you design authorization for project and job APIs?

How do you design authorization for project and job APIs?

Authentication identifies the caller. Authorization decides whether that caller may act on a particular project, job, or artifact.

Check the requested resource

Resolve the project or job through the authenticated user’s permitted scope. Do not trust an owner identifier supplied by the browser. Apply checks to reads, updates, generation requests, cancellation, and downloads. A hidden UI control is not a server-side permission boundary.

Test indirect access paths

A job status response can reveal private metadata, and a download signer can expose a private file. Verify those paths as carefully as the main project endpoint. Test with two accounts and attempt to substitute identifiers from the other account. Define administrative access explicitly rather than creating a broad bypass. Document these rules in the API contract so frontend assumptions match backend enforcement.