September 20, 2026
Permission on the parent is not permission on every child
Owning or editing a project does not automatically mean you can read every nested document, secret, or teammate’s private draft under it.
By Auth By Example
Authorize the specific object the request touches. Inheritance is a product choice you must encode on purpose — not an accident of URL nesting like /projects/:id/docs/:docId.
Otherwise you get classic IDOR-shaped bugs: the parent check passes, the child id in the path is never verified against the caller's rights, and the API still returns 200.
If you want cascading rights, define them explicitly (and test the deny paths). If you do not, check authorization at every level you expose.