3:I[5711,["990","static/chunks/990-a84aea244cca90e0.js","612","static/chunks/612-121f3f9105640b4b.js","308","static/chunks/app/blog/%5Bslug%5D/page-43a902553bd892c2.js"],"default"] 4:I[2972,["990","static/chunks/990-a84aea244cca90e0.js","612","static/chunks/612-121f3f9105640b4b.js","308","static/chunks/app/blog/%5Bslug%5D/page-43a902553bd892c2.js"],""] 5:I[2834,["990","static/chunks/990-a84aea244cca90e0.js","612","static/chunks/612-121f3f9105640b4b.js","308","static/chunks/app/blog/%5Bslug%5D/page-43a902553bd892c2.js"],"default"] 6:I[4707,[],""] 8:I[6423,[],""] 2:T5e8,{"@context":"https://schema.org","@graph":[{"@type":"BlogPosting","@id":"https://sreerajpalat.dev/blog/permissions-are-a-product#post","headline":"Permissions are the product","description":"Model the decision. Roles come later.","datePublished":"2026-04-03","dateModified":"2026-04-03","url":"https://sreerajpalat.dev/blog/permissions-are-a-product","inLanguage":"en","keywords":"Permissions, Systems","image":"https://sreerajpalat.dev/og.png","articleBody":"A permission bug is usually a model that does not match how the organization decides. “Manager can edit employees” fails the moment salary and address belong to different people.\n\nStart from the record and the action: who may read the field, change the state, approve the move. The API refuses what the screen does not offer. A flat role table is how sensitive data leaks.","author":{"@id":"https://sreerajpalat.dev/#person"},"publisher":{"@id":"https://sreerajpalat.dev/#person"},"mainEntityOfPage":"https://sreerajpalat.dev/blog/permissions-are-a-product","isPartOf":{"@id":"https://sreerajpalat.dev/blog#blog"}},{"@type":"BreadcrumbList","@id":"https://sreerajpalat.dev/blog/permissions-are-a-product#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://sreerajpalat.dev"},{"@type":"ListItem","position":2,"name":"Writing","item":"https://sreerajpalat.dev/blog"},{"@type":"ListItem","position":3,"name":"Permissions are the product","item":"https://sreerajpalat.dev/blog/permissions-are-a-product"}]}]}7:["slug","permissions-are-a-product","d"] 9:T55f,{"@context":"https://schema.org","@graph":[{"@type":"Person","@id":"https://sreerajpalat.dev/#person","name":"Sreeraj Palat","jobTitle":"Senior Software Engineer","description":"Senior software engineer. Enterprise backends, data models, and systems a business already depends on.","url":"https://sreerajpalat.dev","email":"sreerajpaalat@gmail.com","telephone":"+91 9809222138","image":"https://sreerajpalat.dev/profile.png","address":{"@type":"PostalAddress","addressLocality":"Coimbatore","addressCountry":"IN"},"homeLocation":{"@type":"Place","name":"Coimbatore, India"},"sameAs":["https://www.linkedin.com/in/sreerajpalat","https://github.com/sreerajpalat","https://wa.me/919809222138"],"knowsAbout":["Python","Flask","Django","Django REST Framework","FastAPI","REST API Development","React.js","Next.js","JavaScript","Redux Toolkit","HTML5","CSS3","PostgreSQL","Microsoft SQL Server","Redis","IIS","Docker","Git","System Architecture","API Integration","Performance Optimization","Legacy System Migration","Enterprise Software Development","AI Integration"]},{"@type":"WebSite","@id":"https://sreerajpalat.dev/#website","url":"https://sreerajpalat.dev","name":"Sreeraj Palat","description":"Senior software engineer. Enterprise backends, data models, and systems a business already depends on.","inLanguage":"en","publisher":{"@id":"https://sreerajpalat.dev/#person"}}]}0:["NyhH9hYFgkZ6mCAVGizPM",[[["",{"children":["blog",{"children":[["slug","permissions-are-a-product","d"],{"children":["__PAGE__?{\"slug\":\"permissions-are-a-product\"}",{}]}]}]},"$undefined","$undefined",true],["",{"children":["blog",{"children":[["slug","permissions-are-a-product","d"],{"children":["__PAGE__",{},[["$L1",[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$2"}}],[["$","$L3",null,{}],["$","main",null,{"id":"main","className":"pb-[calc(4.25rem+env(safe-area-inset-bottom))] pt-14 xl:pb-0 xl:pt-16","children":["$","article",null,{"className":"pb-16 pt-10 sm:pb-24","children":["$","div",null,{"className":"frame","children":[["$","nav",null,{"aria-label":"Breadcrumb","className":"text-sm text-stone","children":["$","ol",null,{"className":"flex flex-wrap items-center gap-x-2","children":[["$","li",null,{"children":["$","$L4",null,{"href":"/","className":"link-underline hover:text-ink","children":"Home"}]}],["$","li",null,{"aria-hidden":true,"children":"/"}],["$","li",null,{"children":["$","$L4",null,{"href":"/blog","className":"link-underline hover:text-ink","children":"Writing"}]}]]}]}],["$","header",null,{"className":"mt-10 max-w-[40rem] border-t border-forest/10 pt-8","children":[["$","p",null,{"className":"kicker","children":["3 April 2026",["$","span",null,{"className":"mx-2 text-forest/30","children":"/"}],"Sreeraj Palat"]}],["$","h1",null,{"className":"mt-4 text-[clamp(2rem,4vw,3rem)] leading-tight tracking-tight text-forest","children":"Permissions are the product"}],["$","p",null,{"className":"mt-4 text-[1.05rem] leading-relaxed text-stone","children":"Model the decision. Roles come later."}]]}],["$","div",null,{"className":"mt-10 max-w-[40rem] space-y-6 text-[1.08rem] leading-[1.75] text-ink/85","children":[["$","p","A permission bug is usually a model that does not match how the organization decides. “Manager can edit employees” fails the moment salary and address belong to different people.",{"children":"A permission bug is usually a model that does not match how the organization decides. “Manager can edit employees” fails the moment salary and address belong to different people."}],["$","p","Start from the record and the action: who may read the field, change the state, approve the move. The API refuses what the screen does not offer. A flat role table is how sensitive data leaks.",{"children":"Start from the record and the action: who may read the field, change the state, approve the move. The API refuses what the screen does not offer. A flat role table is how sensitive data leaks."}]]}]]}]}]}],["$","$L5",null,{}]]],null],null],null]},[null,["$","$L6",null,{"parallelRouterKey":"children","segmentPath":["children","blog","children","$7","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[null,["$","$L6",null,{"parallelRouterKey":"children","segmentPath":["children","blog","children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":"$undefined","notFoundStyles":"$undefined"}]],null]},[[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/29a13059a0ff4ba2.css","precedence":"next","crossOrigin":"$undefined"}]],["$","html",null,{"lang":"en","className":"__variable_d1783d","children":["$","body",null,{"className":"font-sans","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$9"}}],["$","$L6",null,{"parallelRouterKey":"children","segmentPath":["children"],"error":"$undefined","errorStyles":"$undefined","errorScripts":"$undefined","template":["$","$L8",null,{}],"templateStyles":"$undefined","templateScripts":"$undefined","notFound":[["$","$L3",null,{}],["$","main",null,{"id":"main","className":"pb-[calc(4.25rem+env(safe-area-inset-bottom))] pt-14 xl:pb-0 xl:pt-16","children":["$","div",null,{"className":"grid min-h-[70svh] place-items-center px-6 py-24","children":["$","div",null,{"className":"max-w-[22ch]","children":[["$","p",null,{"className":"text-sm text-stone","children":"404"}],["$","h1",null,{"className":"mt-3 text-[clamp(2rem,4vw,3rem)] font-medium tracking-tight text-ink","children":"This page doesn’t exist."}],["$","p",null,{"className":"mt-6 max-w-[36ch] text-[1.05rem] leading-relaxed text-stone","children":"The address may be mistyped, or the page has moved."}],["$","$L4",null,{"href":"/","className":"btn mt-8","children":["Back to ","Sreeraj"]}]]}]}]}],["$","$L5",null,{}]],"notFoundStyles":[]}]]}]}]],null],null],["$La",null]]]] a:[["$","meta","0",{"name":"viewport","content":"width=device-width, initial-scale=1, viewport-fit=cover"}],["$","meta","1",{"name":"theme-color","content":"#F7F4EE"}],["$","meta","2",{"name":"color-scheme","content":"light"}],["$","meta","3",{"charSet":"utf-8"}],["$","title","4",{"children":"Permissions are the product — Sreeraj Palat"}],["$","meta","5",{"name":"description","content":"Model the decision. Roles come later."}],["$","meta","6",{"name":"application-name","content":"Sreeraj Palat"}],["$","link","7",{"rel":"author","href":"https://sreerajpalat.dev"}],["$","meta","8",{"name":"author","content":"Sreeraj Palat"}],["$","link","9",{"rel":"manifest","href":"/manifest.webmanifest","crossOrigin":"use-credentials"}],["$","meta","10",{"name":"keywords","content":"Permissions,Systems"}],["$","meta","11",{"name":"creator","content":"Sreeraj Palat"}],["$","meta","12",{"name":"robots","content":"index, follow"}],["$","meta","13",{"name":"googlebot","content":"index, follow, max-video-preview:-1, max-image-preview:large, max-snippet:-1"}],["$","meta","14",{"name":"category","content":"portfolio"}],["$","link","15",{"rel":"canonical","href":"https://sreerajpalat.dev/blog/permissions-are-a-product"}],["$","link","16",{"rel":"alternate","type":"application/rss+xml","href":"https://sreerajpalat.dev/feed.xml"}],["$","meta","17",{"name":"apple-mobile-web-app-capable","content":"yes"}],["$","meta","18",{"name":"apple-mobile-web-app-title","content":"Sreeraj Palat"}],["$","meta","19",{"name":"apple-mobile-web-app-status-bar-style","content":"default"}],["$","meta","20",{"property":"og:title","content":"Permissions are the product — Sreeraj Palat"}],["$","meta","21",{"property":"og:description","content":"Model the decision. Roles come later."}],["$","meta","22",{"property":"og:url","content":"https://sreerajpalat.dev/blog/permissions-are-a-product"}],["$","meta","23",{"property":"og:site_name","content":"Sreeraj Palat"}],["$","meta","24",{"property":"og:locale","content":"en_IN"}],["$","meta","25",{"property":"og:image","content":"https://sreerajpalat.dev/og.png"}],["$","meta","26",{"property":"og:image:width","content":"1200"}],["$","meta","27",{"property":"og:image:height","content":"630"}],["$","meta","28",{"property":"og:image:alt","content":"Sreeraj Palat — Senior Software Engineer"}],["$","meta","29",{"property":"og:type","content":"article"}],["$","meta","30",{"property":"article:published_time","content":"2026-04-03"}],["$","meta","31",{"property":"article:author","content":"Sreeraj Palat"}],["$","meta","32",{"property":"article:tag","content":"Permissions"}],["$","meta","33",{"property":"article:tag","content":"Systems"}],["$","meta","34",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","35",{"name":"twitter:title","content":"Permissions are the product — Sreeraj Palat"}],["$","meta","36",{"name":"twitter:description","content":"Model the decision. Roles come later."}],["$","meta","37",{"name":"twitter:image","content":"https://sreerajpalat.dev/og.png"}],["$","link","38",{"rel":"icon","href":"/icon.svg","type":"image/svg+xml"}],["$","link","39",{"rel":"apple-touch-icon","href":"/icon.svg"}]] 1:null