# Authorization

## Purpose

Control access to resources.

---

# User Isolation

A user must only access:

- Their jobs.
- Their CV.
- Their files.
- Their emails.
- Their settings.

---

# Admin Role

Admins may access:

- System settings.
- Provider configuration.
- Monitoring.

---

# API Rules

Every protected endpoint must verify:

1. User identity.
2. User permission.
3. Resource ownership.

---

# Never Trust Frontend

The backend must enforce permissions.