How a B2B SaaS team used custom ESLint rules to enforce API access control

Engineers at Malibou, an HRIS and payroll platform built on Next.js, developed custom ESLint linter rules to enforce access control across all API routes and server actions. The core challenge was horizontal authorization — ensuring every database query validates that a specific row belongs to the requesting user's organization, not just that the user is authenticated. Because tenant-based row-level security in SQL could not capture complex, role-dependent business rules, the team chose to enforce their existing TypeScript logic structurally through linting. Their first custom rule requires every server entry point to pass through a central middleware that handles authentication and permission checks, causing non-compliant routes to fail CI. The approach addresses Broken Object Level Authorization, which has ranked at the top of the OWASP API Security Top 10 for several years.