Implement an admin publish endpoint that requires `content.publish` without checking role names in the handler.

Only authenticated users carrying content.publish may publish a content item. Editors without that capability receive 403 even if they can update drafts.

An admin token publishes successfully; an editor token reaches authentication but is denied by authorization.

• Use a named policy.
• Keep role names out of the endpoint.
• Return 401 for no valid identity and 403 for insufficient capability.
• Audit only successful state changes and meaningful denials.

I register the capability requirement once and attach the policy declaratively. Authentication builds the identity; authorization evaluates the specific command permission before the handler executes.

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("content.publish", policy =>
        policy.RequireAuthenticatedUser()
              .RequireClaim("capability", "content.publish"));
});

app.MapPost("/admin/content/{id:guid}/publish", async (
    Guid id, ContentService content, ClaimsPrincipal user, CancellationToken ct) =>
{
    var result = await content.PublishAsync(id, user.RequireUserId(), ct);
    return result switch {
        PublishResult.Published item => Results.Ok(ContentResponse.From(item.Value)),
        PublishResult.NotFound => Results.NotFound(),
        PublishResult.Conflict conflict => Results.Conflict(new ProblemDetails {
            Title = conflict.Reason,
            Status = StatusCodes.Status409Conflict
        }),
        _ => Results.StatusCode(StatusCodes.Status500InternalServerError)
    };
}).RequireAuthorization("content.publish");

The endpoint states its permission requirement without coupling the domain operation to today’s role model. The service still enforces lifecycle rules such as already-published or invalid content.

• The token is missing.
• The token is valid but lacks capability.
• Capability changes after token issuance.
• The content is already published.

• Call the endpoint with anonymous, editor, and publisher identities.
• Assert the service is never called on denial.
• Exercise conflict separately from 403.

• Checking IsInRole("Admin") inside every handler.
• Hiding the button and skipping API authorization.
• Returning 404 for every policy denial without a deliberate contract.
• Treating a business conflict as 403.