Designing safer listItems and getItem permissions

When you implement authorization for an endpoint that returns a list of items, there is an optimization that simplifies the policy structure a bit: define only the permission to list but not to get items . This makes it a bit easier for a policy writer to think about permissions as there is less duplication. For example, in a ticketing system that provides an endpoint to list tickets (…