One permissions layer. Every app on the platform. Zero copies of the rules.

Last week I showed you Funding — one app on the Own the Podium platform. The part I'm proudest of isn't inside it.

Roles and permissions don't live in Funding, or Performance, or User Management. They live in one shared layer underneath all of them. Every app asks the same question the same way — can this role take this action at this stage? — and none of them keeps its own copy of the rules.

What that buys you: a new app means registering its actions, not rebuilding auth. Switching a role on for Funding and off for Performance is a toggle, not a deploy. And there's one audit trail, because there's only one place an action can be permitted.

The front ends are independent micro-frontends; the permissions layer is what makes them behave like one product.

Someone in the comments last week called it decoupling permissions from static roles. I'd go one further: decouple them from the app, too.

Case study: https://contra.com/p/LUcLmQUE-own-the-podium-role-based-funding-platform