# Authorization & least privilege

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/authorization

Layer authorization on top of authentication: roles or scopes that decide what an identified caller may actually do.

Usually comes after: [Your data is yours](https://gradus.kazet.blog/tree/cloud-application/step/data-ownership).

Leads to: [Audit logging](https://gradus.kazet.blog/tree/cloud-application/step/audit-logging).

## Prompt for your AI assistant

```
Add role-based or scope-based authorization on top of the existing authentication, and enforce least-privilege access on every protected route.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt