Permission-Based Authorization in ASP.NET Core

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. “Which roles hold that permission becomes data you change through an API call, not code you redeploy.” I first published this in January 2021, on .NET 5, with MVC controllers and Razor views. This is the full .NET 10 rebuild: Minimal APIs, no views, and two bugs from the original that I want to walk through honestly, because both fail silently.

   In Outbound stack governance

2. Permission-based authorization is a model where endpoints demand a named capability rather than a group membership. The endpoint says “the caller must hold Permissions.Products.Delete” and says nothing about who holds it. “When you check the action, the mapping from people to actions moves out of your source code and into your database, where an admin can edit it at two in the morning without waiting for a deployment slot.” In ASP.NET Core this is not a separate feature. It is policy-based authorization with two additions: permissions stored as claims on the role, and a custom policy provider that manufactures a policy for any permission name it sees.

   In Workflow automation