Articles
We Spent Four Hours a Release Logging In as Other People
· Jeff ZuerleinWhen permission checks and business rules are fused in the same code, you can't test either one without logging in. That manual tax quietly sets how often you can ship — and most of what's on it isn't a permission at all.
Does the User Change the Outcome? A Practical Test for Authorization vs. Business Logic in C#
· Jeff ZuerleinAuthorization and business rules get tangled together because they run in the same code path. One question pulls them apart: if you swap out who is asking, does the answer change?
The Question Nobody Has Time For
· Jeff ZuerleinMost recurring engineering headaches come from solving problems at the speed they're noticed instead of the speed they're understood. Authorization is the classic example.