{
  "context": "Tests whether the agent replaces a flat role-based permission model with attribute-based or relationship-based access control, centralizes authorization in middleware/policies, and designs permissions according to least privilege principles.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "ABAC or ReBAC implementation",
      "description": "The access control logic uses attributes (e.g. resource ownership, team membership, sensitivity level, subscription tier) or relationships (e.g. user-to-resource edges) rather than relying solely on a flat role-to-permission mapping. At least one access decision involves checking a resource attribute or user-resource relationship beyond just the user's role label.",
      "max_score": 5
    },
    {
      "name": "Centralized authorization",
      "description": "Permission evaluation is performed in a single shared location (e.g. a policy module, decorator, or middleware) — NOT re-implemented independently inside each route handler.",
      "max_score": 30
    },
    {
      "name": "Generic 403/404 on denial",
      "description": "When access is denied, the response does NOT reveal whether the resource exists — returns a generic 403 or uniform 404 rather than a message that distinguishes 'not found' from 'forbidden'.",
      "max_score": 30
    },
    {
      "name": "Sequential IDs flagged",
      "description": "Either the code, comments, or security_notes.md flags the use of integer/sequential resource IDs as a security concern and recommends non-enumerable identifiers (UUIDs or random IDs).",
      "max_score": 35
    }
  ]
}