A read-only open-data client token must not be able to call write endpoints on the same municipal API. How should access be enforced?
Select an answer to reveal the explanation.
Short Explanation
A library card should not unlock the vault. Enforce scopes or claims at the authorizer so a read-only open-data token cannot POST or DELETE. One JWT-to-rule-them-all is how open data turns into open season.
Full Explanation
Fine-grained API authorization uses scopes and claims evaluated by API Gateway authorizers or application logic so tokens issued for read-only clients cannot invoke write routes. Treating any valid JWT as fully privileged collapses that control. Sharing admin credentials or publishing write keys publicly contradicts least privilege.