---
url: https://scruple.dev/rules/security/no-user-controlled-authorization.md
description: Disallow authorization based on attacker-controlled claims.
---

# security/no-user-controlled-authorization

Disallow authorization based on attacker-controlled claims.

## What it checks

Do not grant access or assign authority from client-controlled roles, permissions, scopes, ownership, tenant, or admin claims without trusted validation.

## Rule metadata

* Package: `@scruple/security`
* Category: Authorization
* Tags: access-control, untrusted-input, roles
* Default threshold: `0.9`
* Minimum confidence: `0.75`

## Examples

### Reported

```ts
if (req.body.role === "admin") deleteUser(req.params.id);
```

### Accepted

```ts
if ((await authz.rolesFor(req.user.id)).includes("admin")) deleteUser(req.params.id);
```