Resource authorization and tenant scope

def may_edit(actor, document):
    return bool(actor and (actor["role"] == "admin" or actor["id"] == document["owner_id"]))
document = {"owner_id": 7}
print(may_edit(None, document))
print(may_edit({"id": 7, "role": "user"}, document))
print(may_edit({"id": 8, "role": "user"}, document))
print(may_edit({"id": 8, "role": "admin"}, document))

False
True
False
True

The result matrix is deny, allow, deny, allow. The role and actor are trusted synthetic inputs; reading them from an unverified request would invalidate the policy boundary.

from typing import Annotated
from fastapi import Depends, FastAPI, HTTPException
from fastapi.testclient import TestClient
def current_user(): return {"id": 7}
def authorized_document(document_id: int, user: Annotated[dict, Depends(current_user)]):
    document = {1: {"id": 1, "owner_id": 7, "text": "public lab text"}}.get(document_id)
    if document is None: raise HTTPException(status_code=404, detail="Missing")
    if document["owner_id"] != user["id"]: raise HTTPException(status_code=403, detail="Forbidden")
    return document
app = FastAPI()
@app.get("/documents/{document_id}")
def document(value: Annotated[dict, Depends(authorized_document)]): return {"id": value["id"]}
with TestClient(app) as client:
    print(client.get("/documents/1").status_code)
    app.dependency_overrides[current_user] = lambda: {"id": 8}
    try:
        print(client.get("/documents/1").status_code)
    finally:
        app.dependency_overrides.clear()

200
403

The synthetic owner succeeds and another synthetic user is forbidden while the actual lookup and policy remain active. current_user is a lab provider, not a real authenticator.