title: Applying Granular Right restriction in ASP.Net core
body: <p><strong>Background</strong></p>
  
  <p>What is the best way to apply granular right level restriction in ASP.Net core. I've have already set up authentication and my application issues tokens that that expire after a certain amount of time.</p>
  
  <p>My web app also makes use of roles and rights, where a certain role is can be associated with a set of rights. I've seeded the rights and restricted access to them in that even admin users cannot change, create or deleted any (i.e. read-only). The roles on the other hand are dynamic, though the super-admin and admin are fixed. Any user with a super-admin access role has the power to create new roles and assign rights to that role.</p>
  
  <p><strong>What I am trying to do is to restrict access to all the other controllers in my application based on these rights.</strong></p>
  
  <p>I am considering using <em>Policy-based authorization</em> where each right will be associated with a specific policy (i.e <code>[Authorize(Policy = "delete users")]</code>). Then I would embed all the rights the user has in the token I issue out on login. </p>
  
  <p>I am reluctant to implementing it this way since, though the rights may be hard coded, they may/will increase in time, if I have a very large number of rights then I may be a bit inefficient to be embedding all of them into the token.</p>
  
  <p>Is there a better to achieve this level of security???</p>