it starts clean. admin, editor, viewer. three roles, clear boundaries, everyone knows what they can do.
then the product grows. a customer needs access to one thing but not another. a team member needs editor rights in one context and read-only in another. someone asks for a role that's basically admin but without the billing tab. and suddenly you have eleven roles, three of them named some variation of 'editor-but-not-really,' and nobody is confident the permissions are actually right anymore.
most teams spend a lot of time thinking about user authentication. who can log in, how, with what credentials.
and then the services behind the scenes just... trust each other. because they're on the same network. because they're in the same VPC. because nobody questioned it when the architecture was first drawn up.
most apps have a session timeout. almost nobody knows why it's set to whatever number it's set to.
ask around and you'll usually get one of three answers. 'that's just the default.' 'someone picked it a while ago and we never changed it.' or 'i think security asked for it but i'm not sure why.'
MonoCloud for Startups
