Skip to main content
Authentication establishes who is signed in. Authorization decides what that person can do. If clients, staff, or administrators see different records, describe those rules explicitly when building.

​
Write an access table

Use your own business rules. Do not grant broad access just because an interface needs an admin screen.

​
Example prompt

Roles and record rules are generated for your app; they require review and testing. They are not a substitute for an access-control review when the data is sensitive.

​
Verify with separate accounts

Test a signed-out visitor, two different clients, and an administrator. Check list pages, detail pages, edits, deletes, and direct requests. A client must not become an administrator by changing a field in their profile or a request body.

​
Public and private publishing are separate

Fabricate’s app visibility controls who can open the published app. Your app’s own roles control what its users can do inside it. A public app may still require sign-in for private records; a private Fabricate app is not a team invitation or client permission system. See Authentication for the built-in sign-in behavior and Test your app for a complete checking sequence.