Ash Framework

Writing Policies for Artists

There are two parts we need to complete when implementing access control in an Ash web app:

• Creating the policies for our resources.
• Updating our web interface to specify the actor when calling actions, as well as niceties like hiding buttons to perform actions if the current user doesn’t have permission to run them.

Which order you do them in is up to you, but both will need to be done. Writing the policies first will break the web interface completely (everything will be forbidden, without knowing who is trying to load or modify data!), but doing it first will ensure we catch all permission-related issues when tweaking our liveviews. We’ll write the policies first while they’re fresh in our minds.

Creating Our First ...