Route-Based Permissions

Covers structural patterns for route permission enforcement: centralized route manifests, guard composition, and nested route inheritance. Assumes basic role/permission primitives exist (can(), requireRole) — focuses on how to wire them across a route tree without scattering checks everywhere.

Discovery

Before writing anything, answer:

1. How many guards per route? Single role check, or multiple independent conditions (auth + role + feature flag + subscription tier)?
2. Route declaration style: File-based (Next.js App Router, Remix) or config-based (React Router createBrowserRouter, Express router)?
3. Nested inheritance: Should child routes inherit parent permissions, or must each route declare its own?
4. Dynamic segments: Do permissions depend on the resource at /:id (ownership checks), or only on role?
5. Backend: Express/Fastify router, or Next.js API/middleware?

Core Patterns