Articles
Org Tree Claims and ASP.NET Core Policies: Technical Reference
· Jeff ZuerleinHow AuthorizationHub converts an organizational tree into ASP.NET Core identity claims, and how to write authorization policies against those claims — with configuration, setup, and policy examples.
Your Permissions Are a Photo of Your Org Chart
· Jeff ZuerleinPermission groups are a snapshot of your org chart taken once and never updated. The fix isn't a better process for updating the photo — it's giving your application an org chart of its own.
We Spent Four Hours a Release Logging In as Other People
· Jeff ZuerleinWhen permission checks and business rules are fused in the same code, you can't test either one without logging in. That manual tax quietly sets how often you can ship — and most of what's on it isn't a permission at all.
Does the User Change the Outcome? A Practical Test for Authorization vs. Business Logic in C#
· Jeff ZuerleinAuthorization and business rules get tangled together because they run in the same code path. One question pulls them apart: if you swap out who is asking, does the answer change?
The Question Nobody Has Time For
· Jeff ZuerleinMost recurring engineering headaches come from solving problems at the speed they're noticed instead of the speed they're understood. Authorization is the classic example.