A simple, convention-based authorization model for REST APIs that removes the guesswork from some of the design decisions and results in a flexible and future-proof design.