---
taskmaster_id: "4.4"
status: "done"
priority: "high"
depends_on: ["2"]
parent_id: "4"
source: "taskmaster"
generated_at: "2026-05-28T11:49:27.076Z"
---

# 4.4 - Create authorization matrix for REST and Socket.IO

- [x] 4.4 - Create authorization matrix for REST and Socket.IO #taskmaster #priority/high #status/done ⏫ 🆔 tm-4-4 ⛔ tm-2

## Metadata

| Field | Value |
| --- | --- |
| Taskmaster ID | 4.4 |
| Status | done |
| Priority | high |
| Dependencies | 2 |
| Parent | 4 - Define backend security and refactor strategy from latest audit |

## Description

Map every endpoint and realtime event to access level, ownership checks, state preconditions, rate-limit tier, and audit-log requirement.

## Details

Include public/authenticated/owner/buyer/seller/admin/support/service-role classifications. Socket.IO rooms must be server-derived from authenticated identity, not client-supplied user IDs.

## Verification

No route or socket event remains unmapped; implementation tasks can reference matrix rows directly.
