February 25, 2026 1 min read
Defense in Depth: Three Layers of Authorization
Concept
Depth: ●●○○○
Proxy rate limiting → server action guards → 168 RLS policies. Why each layer exists and what happens when the others fail.
Three Layers
Layer 1 (Proxy): Upstash Redis rate limiters + role-based route guards. Layer 2 (Server Actions): requireAdmin()/requireStaff() guards with React cache(). Layer 3 (Database): 168 RLS policies — even if layers 1-2 fail, the database refuses unauthorized access.
Why All Three?
Any single layer can fail: forgotten guard, proxy bug, RLS gap. With three layers, two can fail and authorization is still enforced. For a platform handling payments and personal data, this guarantee matters.