A modular monolith is one deployable application divided into independent modules with clear boundaries. Each module owns a domain’s data, business logic, and authorization rules, reducing the tangled dependencies found in nonmodular monoliths. section 17.2.1 section 17.3
For authorization, modular boundaries provide practical safeguards:
- The Invoices module can enforce who may create, view, or approve invoices because it owns the relevant context. section 17.2.1
- Rules remain encapsulated instead of being scattered across controllers, services, and helpers or centralized in one oversized security service. section 17.2.1
- A single deployable unit preserves shared identity and permission context while module separation supports consistent enforcement, auditing, and testing. section 17.3 section 17.2.1
Invoice authorization
An Invoices module loads a user and an invoice, then applies context-aware rules such as whether user.department equals invoice.department. The module protects its own invoice resources rather than relying on unrelated application code. section 17.2.1
