---
title: "Access"
description: "Who may call which backend function, and what each role and permission allows."
canonical_url: "https://nuxt-backend.dev/docs/auth/access"
---
# Access

> Who may call which backend function, and what each role and permission allows.

Access is decided on the server, in every function, from the caller's identity and a fresh read where it matters. The browser only mirrors it, to hide what a person cannot use.

<card-group>
<card icon="i-lucide-shield" title="Protect backend functions" to="https://nuxt-backend.dev/docs/auth/access/functions">

The `authed`, `org`, `admin` and `withRole` builders.

</card>

<card icon="i-lucide-users-round" title="Authorization" to="https://nuxt-backend.dev/docs/auth/access/roles">

`setupAuthorization`, custom roles, the client's role checks and `<RoleBoundary>`.

</card>
</card-group>


## Sitemap

See the full [sitemap](https://nuxt-backend.dev/sitemap.md) for all pages.