aspnetcore-authorization

From README

ASP.NET Core Authorization When to Use This Skill Use this skill when: Implementing policy-based authorization in ASP.NET Core Protecting API endpoints with scope-based or claim-based checks Writing custom IAuthorizationHandler implementations Configuring authorization for Minimal APIs, controllers, or Razor Pages Enforcing role-based access control using OIDC claims Combining multiple authorization requirements into composite policies Core Principles Policy-Based Over Role-Based — Use authorization policies instead of [Authorize(Roles = "...")]. Policies are composable, testable, and decoupled from claim types. Scope ≠ Permission — OAuth scopes represent what the client is allowed to do. User claims represent what the user is allowed to do. Combine both for proper API authorization. Authorization is Separate from Authentication — Authentication (see aspnetcore-authentication) establishes identity. Authorization decides access based on that identity.