Access control
2026
Decomposing hardcoded roles: rewriting access control in a Django app without breaking customers
How we replaced three hardcoded roles with 46 named permissions and customer-defined roles, and proved nothing changed before changing anything.