Real Decision

Capability-based Authorization

Why permissions and billing entitlements were separated from business logic.

Problem

Traditional role-based permissions become difficult to maintain when features, plans and workspace capabilities evolve independently.

Decision

Built a capability layer that combines workspace membership, role and billing entitlements to determine whether a member can perform a specific action. This keeps authorization consistent and avoids duplicating permission checks across modules.

Why Not

Hard-code permission checks inside every domain service.

Bind product access directly to static role names.