Auth
Identity, authentication, and authorization — how Localz knows who a user is and what they're allowed to do.
Why we need this / what value this brings
Auth mistakes are some of the most damaging in production — get the model right before building features on top of it.
When to use this
Design AuthN/AuthZ boundaries before building any feature that distinguishes between user types (customer vs provider vs admin).
How to use or implement this
Use a managed provider (Clerk, already in use) for AuthN, and build explicit, testable AuthZ checks in app code on top of it.
Subtopics
Research questions
- Localz uses Clerk today — which of these subtopics does Clerk already solve vs still requires app-level decisions (RBAC)?
Empty folder — drop notes, links, and findings here as you research.