In REST API design, separation of duties is not optional. It is the line between a controlled system and chaos. This principle demands that no single role, service, or process can perform every critical action without oversight. In practice, it means structure in endpoints, structure in permissions, and structure in how requests flow through the system.
A robust separation of duties in REST APIs starts with defining clear roles. Each role should only have the minimum privileges to perform its tasks—least privilege combined with strict access controls. Admin endpoints must be split from operational endpoints. Write endpoints to enforce these distinctions at the resource level, not just in external documentation.
Authentication and authorization logic must be centralized but not conflated. The authentication service should only confirm identities. The authorization process should operate independently, applying rules defined by policy, not by developer shortcuts. This prevents identity spoofing and privilege escalation from exploiting a single weak point.
Audit logging is a core requirement. Every critical action—data creation, update, deletion—must produce immutable logs that are tied to both a user identity and role. Those logs should be reviewed by a separate function from the one that executes the actions. No endpoint should process requests without automatically creating corresponding entries in the audit stream.