Ultrahost/ docs
All primitives

Security

Authorization Layer

Decide who can see and do what.

The idea

Imagine building a school management application.

Teachers can enter grades.

Students can see their own grades.

Parents can see their children's grades.

But students shouldn't be able to change grades or see everyone else's information.

That's what Authorization is for.

Application blip

School Portal

Permission demo

View as:

Switch roles to see how permissions change.

Gradebook · Can view and edit class grades

Class grades

All students in homeroom 8A

Maya Chen

Grade 8 · homeroom 8A

Math
A-
Science
A
English
B+

Eli Parker

Grade 8 · homeroom 8A

Math
B
Science
B+
English
A-

Sofia Alvarez

Grade 8 · homeroom 8A

Math
A
Science
B
English
A

Noah Bennett

Grade 8 · authorized child

Math
B+
Science
A-
English
B

Simulation only: role changes update this view. Real applications must enforce permissions on the server.

Behind the scenes

  1. User identity + Resource + Requested action
  2. Permission check
  3. Allow / Deny

The system considers who is asking, which resource they want, and what they want to do. A permission check runs before the application allows or denies that action.

What could you build?

  • Multi-user business applications
  • Client portals
  • Team collaboration tools
  • Enterprise software

Implementation notes

  • Name permissions after actions, not screens.
  • Check policy on the server boundary.
  • Test allow and deny paths as equals.

Implementing it

With a coding agent

Ask your agent to control access

Agent setup (mock link)

Copy this prompt, fill in the bracketed details, and paste it into your coding agent. It describes the goal, the permission rules, and the guardrails.

Bracketed text marks details only you can fill in. 821 / 6,000 characters.

Fill in:APP OR PRODUCTROLESEXAMPLE ACTIONSWHAT EACH ROLE CAN DORESOURCES TO PROTECTOWNERSHIP OR SHARING RULESIMPORTANT ALLOW AND DENY CASES

Good foundation · 72/100

Traditional SDK / API

Check permission before an action

TypeScript
await ultrahost.authz.assert({
  subject: user.id,
  action: "grades:update",
  resource: { type: "student-grade", studentId },
})

Key takeaway

Authentication determines who someone is. Authorization determines what they’re allowed to do.

Next primitive

Session Storage for Agents