Security concepts

Mark which parts of the application require sign-in and which roles may reach them, and Nodlume generates the matching auth wiring and guards. Access rules are expressed on the canvas rather than bolted on afterward.

Two behaviours, on purpose

A protected page guards the whole route: someone without the role is redirected to sign in. A protected API route answers with a 403 instead. The difference matters — a redirect is meaningful to a browser navigating between pages and meaningless to a client that asked for data.

Baseline and exceptions

The access matrix stores a default policy plus the pairs that deviate from it. Under an allow baseline everything is permitted and the exceptions are denials; under deny nothing is permitted and the exceptions are grants. Keeping a baseline rather than a filled grid means a page added later inherits the policy automatically, with nothing to backfill.

The Security tab is where the matrix is edited, and role guards placed in Structure's Nav view appear there as derived denials.