A monolithic application keeps business logic, data access, and user interactions in one codebase, usually within one process or deployable unit. This makes authorization practical because user, resource, and business context are available where access decisions occur. section 17.2.1
Authorization in a monolith can use several models:
- RBAC checks roles such as ADMIN or MANAGER and is usually the simplest starting point. section 17.2.1
- ABAC evaluates attributes such as department or region, for example allowing access when user.department equals invoice.department. section 17.2.1
- ReBAC evaluates relationships such as membership or ownership among users, teams, projects, and documents. section 17.2.1
A nonmodular monolith can scatter authorization across controllers, services, and helpers, allowing checks to be missed. A modular monolith keeps one deployable unit while separating modules and their data, improving consistency and auditing without distributed-service complexity. section 17.2.1 section 17.3
