{
  "id": 9539651,
  "title": "Project access is not object permission",
  "url": "https://urgent.news/2026/09/24/project-access-is-not-object-permission",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-24T10:48:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/authbyexample1/project-access-is-not-object-permission-2n7d"
  },
  "original_language": "en",
  "account": null,
  "summary": "Having access to a project, workspace, or tenant does not mean every nested action is allowed. Read on the folder is not delete on every child. Member of the org is not admin on every resource inside it. Authorize each request as subject + action + resource — including nested objects — instead of stopping at “they can see the parent.”",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}