Write permission is not delete permission
A
Practical lessons on auth, authorization, and access control.
A role that can update a record is often treated as if it can remove it too. Those are different decisions.
Write usually means change fields the caller is allowed to edit. Delete means the resource goes away (or is soft-deleted), related data may cascade, and audit trails change. Many products also treat restore, purge, and archive as separate actions.
Check the verb you actually need:
- Can the subject update this object?
- Can they soft-delete it?
- Can they hard-delete or purge it?
Map those to separate permissions (or at least separate policy rules). Collapsing them into a single "write" flag is how "editors" accidentally become able to wipe production data.
If your API uses one PUT/PATCH path for edits and a DELETE for removal, authorize each route on its own action. Same subject, same resource, different decision.