Confirm authorization on GraphQL resolvers per field
Route-level auth misses GraphQL entirely; each resolver that returns sensitive data needs its own check.
Tag: authorization
Separate authentication from authorization in review
Most access bugs are objects fetched by id without an ownership check, not missing login gates.
Confused-deputy data leak across an agent’s contexts
An agent with broad permissions can be steered to read data one user should not see and hand it to another via its own output.