Create scope in Authorize

Signed-off-by: Bryan Frimin <bryan@probo.com>

contrib/claude/authorization.md

@@ -37,7 +37,7 @@ The evaluator processes all statements against a request:
 `Authorizer` is the main orchestrator in `pkg/iam/authorizer.go`:
 
 ```go
-err := iamService.Authorizer.Authorize(ctx, iam.AuthorizeParams{
+scope, err := iamService.Authorizer.Authorize(ctx, iam.AuthorizeParams{
 	Principal:          identityID,    // who
 	Resource:           thirdPartyID,      // what
 	Action:             probo.ActionThirdPartyGet,  // which action
@@ -51,7 +51,8 @@ The flow:
 3. Load resource attributes via `AuthorizationAttributes()` on the entity
 4. Build policies: identity-scoped + role-specific
 5. Evaluate all policies
-6. Return `ErrInsufficientPermissions` if no allow match
+6. Return an authorization scope (`*coredata.Scope`) for downstream data access
+7. Return `ErrInsufficientPermissions` if no allow match
 
 ## PolicySet
 
@@ -126,14 +127,16 @@ var (
 
 **GraphQL resolvers** use `AuthorizeFunc` from `pkg/server/api/authz/`:
 ```go
-if err := authorize(ctx, thirdPartyID, probo.ActionThirdPartyGet); err != nil {
+scope, err := authorize(ctx, thirdPartyID, probo.ActionThirdPartyGet)
+if err != nil {
 	return nil, err
 }
 ```
 
 **MCP resolvers** use `Authorize` and return early on error:
 ```go
-if err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyGet); err != nil {
+scope, err := r.Authorize(ctx, input.ID, probo.ActionThirdPartyGet)
+if err != nil {
 	return nil, types.GetThirdPartyOutput{}, err
 }
 ```
@@ -183,7 +186,7 @@ When adding a new entity that needs authorization:
 2. **Role policies** — wire actions into the appropriate role policies in `pkg/probo/policies.go` (`OwnerPolicy`, `AdminPolicy`, `ViewerPolicy`, etc.) with `organization_id` condition
 3. **`AuthorizationAttributes`** — implement on the `coredata` entity struct, returning at minimum `{"organization_id": ...}` (use the denormalized `OrganizationID` field — see coredata doc)
 4. **Entity type registry** — register in `pkg/coredata/entity_type_reg.go` and `NewEntityFromID` so the authorizer can construct the entity from its GID
-5. **Resolver calls** — add `r.authorize(ctx, id, probo.ActionEntityGet)` in GraphQL resolvers and `if err := r.Authorize(ctx, id, probo.ActionEntityGet); err != nil { return nil, types.GetEntityOutput{}, err }` in MCP resolvers
+5. **Resolver calls** — add `scope, err := r.authorize(ctx, id, probo.ActionEntityGet)` in GraphQL resolvers and `scope, err := r.Authorize(ctx, id, probo.ActionEntityGet)` in MCP resolvers, then pass `scope` to services
 
 ## Key patterns
 

contrib/claude/mcp.md

@@ -65,7 +65,8 @@ First return is always `nil`. Authorization errors are returned and handled like
 Use `Authorize` with an early return:
 
 ```go
-if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil {
+scope, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList)
+if err != nil {
 	return nil, types.ListThirdPartiesOutput{}, err
 }
 ```
@@ -75,7 +76,7 @@ if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); er
 **List with pagination:**
 ```go
 func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartiesInput) (*mcp.CallToolResult, types.ListThirdPartiesOutput, error) {
-	if err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil {
+	if _, err := r.Authorize(ctx, input.OrganizationID, probo.ActionThirdPartyList); err != nil {
 		return nil, types.ListThirdPartiesOutput{}, err
 	}
 
@@ -106,7 +107,7 @@ func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRe
 **Get single resource:**
 ```go
 func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error) {
-	if err := r.Authorize(ctx, input.ID, probo.ActionRiskGet); err != nil {
+	if _, err := r.Authorize(ctx, input.ID, probo.ActionRiskGet); err != nil {
 		return nil, types.GetRiskOutput{}, err
 	}
 
@@ -124,7 +125,7 @@ func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, in
 **Create:**
 ```go
 func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error) {
-	if err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil {
+	if _, err := r.Authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil {
 		return nil, types.AddRiskOutput{}, err
 	}
 

pkg/iam/authorizer.go

@@ -71,18 +71,32 @@ func (a *Authorizer) RegisterPolicySet(ps *PolicySet) {
 }
 
 // Authorize checks if the principal is allowed to perform the action on the resource.
-func (a *Authorizer) Authorize(ctx context.Context, params AuthorizeParams) error {
+func (a *Authorizer) Authorize(ctx context.Context, params AuthorizeParams) (*coredata.Scope, error) {
 	if params.Principal.EntityType() != coredata.IdentityEntityType {
-		return NewUnsupportedPrincipalTypeError(params.Principal.EntityType())
+		return nil, NewUnsupportedPrincipalTypeError(params.Principal.EntityType())
 	}
 
-	return a.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error { return a.authorize(ctx, tx, params) })
+	var scope *coredata.Scope
+
+	if err := a.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
+		authorizedScope, err := a.authorize(ctx, tx, params)
+		if err != nil {
+			return err
+		}
+
+		scope = authorizedScope
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	return scope, nil
 }
 
-func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizeParams) error {
+func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizeParams) (*coredata.Scope, error) {
 	resourceAttrs, err := a.buildResourceAttributes(ctx, tx, params)
 	if err != nil {
-		return fmt.Errorf("cannot build resource attributes: %w", err)
+		return nil, fmt.Errorf("cannot build resource attributes: %w", err)
 	}
 
 	resourceOrgID := resourceAttrs["organization_id"]
@@ -90,7 +104,7 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa
 	// Find role for resource's organization
 	membership, err := a.loadMembership(ctx, tx, params.Principal, resourceOrgID)
 	if err != nil {
-		return fmt.Errorf("cannot load memberships for principal: %w", err)
+		return nil, fmt.Errorf("cannot load memberships for principal: %w", err)
 	}
 
 	// Check whether the viewer is currently assuming the org of the accessed resource
@@ -102,14 +116,14 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa
 			membership.ID,
 		); err != nil {
 			if _, ok := errors.AsType[*ErrSessionNotFound](err); ok {
-				return NewAssumptionRequiredError(params.Principal, membership.ID)
+				return nil, NewAssumptionRequiredError(params.Principal, membership.ID)
 			}
 
 			if _, ok := errors.AsType[*ErrSessionExpired](err); ok {
-				return NewAssumptionRequiredError(params.Principal, membership.ID)
+				return nil, NewAssumptionRequiredError(params.Principal, membership.ID)
 			}
 
-			return fmt.Errorf("cannot get active child session for membership: %w", err)
+			return nil, fmt.Errorf("cannot get active child session for membership: %w", err)
 		}
 	}
 
@@ -129,7 +143,7 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa
 
 	principalAttrs, err := a.buildPrincipalAttributes(ctx, tx, params.Principal, scopedPrincipalAttrs)
 	if err != nil {
-		return fmt.Errorf("cannot build principal attributes: %w", err)
+		return nil, fmt.Errorf("cannot build principal attributes: %w", err)
 	}
 
 	if params.Session != nil {
@@ -149,11 +163,21 @@ func (a *Authorizer) authorize(ctx context.Context, tx pg.Tx, params AuthorizePa
 	}
 
 	if a.evaluator.Evaluate(req, policies).IsAllowed() {
+		scope := coredata.NewScopeFromObjectID(params.Resource)
+		if resourceOrgID != "" {
+			orgID, err := gid.ParseGID(resourceOrgID)
+			if err != nil {
+				return nil, fmt.Errorf("cannot parse organization id from resource attributes: %w", err)
+			}
+
+			scope = coredata.NewScope(orgID.TenantID())
+		}
+
 		a.recordAuditLog(ctx, tx, params, resourceAttrs)
-		return nil
+		return scope, nil
 	}
 
-	return NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action)
+	return nil, NewInsufficientPermissionsError(params.Principal, params.Resource, params.Action)
 }
 
 func (a *Authorizer) loadMembership(

pkg/server/api/authz/authorization.go

@@ -28,7 +28,7 @@ import (
 
 type (
 	AuthorizeFuncOption func(*iam.AuthorizeParams)
-	AuthorizeFunc       func(context.Context, gid.GID, string, ...AuthorizeFuncOption) error
+	AuthorizeFunc       func(context.Context, gid.GID, string, ...AuthorizeFuncOption) (*coredata.Scope, error)
 )
 
 func WithAttr(key, value string) AuthorizeFuncOption {
@@ -60,7 +60,7 @@ func NewAuthorizeFunc(
 		objectID gid.GID,
 		action string,
 		options ...AuthorizeFuncOption,
-	) error {
+	) (*coredata.Scope, error) {
 		identity := authn.IdentityFromContext(ctx)
 		session := authn.SessionFromContext(ctx)
 
@@ -78,24 +78,25 @@ func NewAuthorizeFunc(
 			option(&params)
 		}
 
-		if err := svc.Authorizer.Authorize(ctx, params); err != nil {
+		scope, err := svc.Authorizer.Authorize(ctx, params)
+		if err != nil {
 			if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok {
-				return gqlutils.AssumptionRequired(ctx, err)
+				return nil, gqlutils.AssumptionRequired(ctx, err)
 			}
 
 			if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok {
-				return gqlutils.Forbidden(ctx, err)
+				return nil, gqlutils.Forbidden(ctx, err)
 			}
 
 			if errors.Is(err, coredata.ErrResourceNotFound) {
-				return gqlutils.NotFoundf(ctx, "resource not found")
+				return nil, gqlutils.NotFoundf(ctx, "resource not found")
 			}
 
 			logger.ErrorCtx(ctx, "cannot authorize", log.Error(err))
 
-			return gqlutils.Internal(ctx)
+			return nil, gqlutils.Internal(ctx)
 		}
 
-		return nil
+		return scope, nil
 	}
 }

pkg/server/api/connect/v1/base_resolvers.go

@@ -146,7 +146,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		return nil, fmt.Errorf("unsupported entity type: %d", id.EntityType())
 	}
 
-	if err := r.authorize(ctx, id, action); err != nil {
+	if _, err := r.authorize(ctx, id, action); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/identity_resolvers.go

@@ -24,7 +24,7 @@ import (
 
 // Profiles is the resolver for the profiles field.
 func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList, authz.WithSkipAssumptionCheck()); err != nil {
 		return nil, err
 	}
 
@@ -68,7 +68,7 @@ func (r *identityResolver) Profiles(ctx context.Context, obj *types.Identity, fi
 
 // Sessions is the resolver for the sessions field.
 func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SessionOrder) (*types.SessionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionSessionList); err != nil {
 		return nil, err
 	}
 
@@ -103,7 +103,7 @@ func (r *identityResolver) Sessions(ctx context.Context, obj *types.Identity, fi
 
 // PersonalAPIKeys is the resolver for the personalAPIKeys field.
 func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Identity, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.PersonalAPIKeyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyList); err != nil {
 		return nil, err
 	}
 
@@ -132,7 +132,7 @@ func (r *identityResolver) PersonalAPIKeys(ctx context.Context, obj *types.Ident
 
 // SsoLoginURL is the resolver for the ssoLoginURL field.
 func (r *identityResolver) SsoLoginURL(ctx context.Context, obj *types.Identity) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionIdentityGet); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/invitation_resolvers.go

@@ -24,7 +24,7 @@ func (r *invitationResolver) Permission(ctx context.Context, obj *types.Invitati
 
 // InviteUser is the resolver for the inviteUser field.
 func (r *mutationResolver) InviteUser(ctx context.Context, input types.InviteUserInput) (*types.InviteUserPayload, error) {
-	if err := r.authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil {
+	if _, err := r.authorize(ctx, input.ProfileID, iam.ActionInvitationCreate); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/membership_resolvers.go

@@ -21,7 +21,7 @@ import (
 
 // LastSession is the resolver for the lastSession field.
 func (r *membershipResolver) LastSession(ctx context.Context, obj *types.Membership) (*types.Session, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
 		return nil, err
 	}
 
@@ -51,12 +51,12 @@ func (r *membershipResolver) Permission(ctx context.Context, obj *types.Membersh
 
 // UpdateMembership is the resolver for the updateMembership field.
 func (r *mutationResolver) UpdateMembership(ctx context.Context, input types.UpdateMembershipInput) (*types.UpdateMembershipPayload, error) {
-	if err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipUpdate); err != nil {
 		return nil, err
 	}
 
 	if input.Role == coredata.MembershipRoleOwner {
-		if err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil {
+		if _, err := r.authorize(ctx, input.MembershipID, iam.ActionMembershipRoleSetOwner); err != nil {
 			return nil, err
 		}
 	}

pkg/server/api/connect/v1/organization_resolvers.go

@@ -84,7 +84,7 @@ func (r *mutationResolver) CreateOrganization(ctx context.Context, input types.C
 
 // UpdateOrganization is the resolver for the updateOrganization field.
 func (r *mutationResolver) UpdateOrganization(ctx context.Context, input types.UpdateOrganizationInput) (*types.UpdateOrganizationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationUpdate); err != nil {
 		return nil, err
 	}
 
@@ -140,7 +140,7 @@ func (r *mutationResolver) UpdateOrganization(ctx context.Context, input types.U
 
 // DeleteOrganization is the resolver for the deleteOrganization field.
 func (r *mutationResolver) DeleteOrganization(ctx context.Context, input types.DeleteOrganizationInput) (*types.DeleteOrganizationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationDelete); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionOrganizationDelete); err != nil {
 		return nil, err
 	}
 
@@ -160,7 +160,7 @@ func (r *mutationResolver) DeleteOrganizationHorizontalLogo(ctx context.Context,
 
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
 		return nil, err
 	}
 
@@ -175,7 +175,7 @@ func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organizat
 
 // HorizontalLogoURL is the resolver for the horizontalLogoUrl field.
 func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -190,7 +190,7 @@ func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types
 
 // Profiles is the resolver for the profiles field.
 func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
 		return nil, err
 	}
 
@@ -228,7 +228,7 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 
 // SamlConfigurations is the resolver for the samlConfigurations field.
 func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SAMLConfigurationConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionSAMLConfigurationList); err != nil {
 		return nil, err
 	}
 
@@ -257,7 +257,7 @@ func (r *organizationResolver) SamlConfigurations(ctx context.Context, obj *type
 
 // ScimConfiguration is the resolver for the scimConfiguration field.
 func (r *organizationResolver) ScimConfiguration(ctx context.Context, obj *types.Organization) (*types.SCIMConfiguration, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
 		return nil, err
 	}
 
@@ -291,7 +291,7 @@ func (r *organizationResolver) ScimBridgeTypes(ctx context.Context, obj *types.O
 
 // AuditLogEntries is the resolver for the auditLogEntries field.
 func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
 		return nil, err
 	}
 
@@ -339,7 +339,7 @@ func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.O
 
 // Viewer is the resolver for the viewer field.
 func (r *organizationResolver) Viewer(ctx context.Context, obj *types.Organization) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/personal_api_key_resolvers.go

@@ -21,7 +21,7 @@ import (
 func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types.CreatePersonalAPIKeyInput) (*types.CreatePersonalAPIKeyPayload, error) {
 	identity := authn.IdentityFromContext(ctx)
 
-	if err := r.authorize(ctx, identity.ID, iam.ActionPersonalAPIKeyCreate); err != nil {
+	if _, err := r.authorize(ctx, identity.ID, iam.ActionPersonalAPIKeyCreate); err != nil {
 		return nil, err
 	}
 
@@ -44,7 +44,7 @@ func (r *mutationResolver) CreatePersonalAPIKey(ctx context.Context, input types
 
 // RevokePersonalAPIKey is the resolver for the revokePersonalAPIKey field.
 func (r *mutationResolver) RevokePersonalAPIKey(ctx context.Context, input types.RevokePersonalAPIKeyInput) (*types.RevokePersonalAPIKeyPayload, error) {
-	if err := r.authorize(ctx, input.PersonalAPIKeyID, iam.ActionPersonalAPIKeyDelete); err != nil {
+	if _, err := r.authorize(ctx, input.PersonalAPIKeyID, iam.ActionPersonalAPIKeyDelete); err != nil {
 		return nil, err
 	}
 
@@ -61,7 +61,7 @@ func (r *mutationResolver) RevokePersonalAPIKey(ctx context.Context, input types
 
 // Token is the resolver for the token field.
 func (r *personalAPIKeyResolver) Token(ctx context.Context, obj *types.PersonalAPIKey) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionPersonalAPIKeyGet); err != nil {
 		return nil, err
 	}
 
@@ -85,7 +85,7 @@ func (r *personalAPIKeyResolver) Permission(ctx context.Context, obj *types.Pers
 func (r *personalAPIKeyConnectionResolver) TotalCount(ctx context.Context, obj *types.PersonalAPIKeyConnection) (*int, error) {
 	switch obj.Resolver.(type) {
 	case *identityResolver:
-		if err := r.authorize(ctx, obj.ParentID, iam.ActionPersonalAPIKeyList); err != nil {
+		if _, err := r.authorize(ctx, obj.ParentID, iam.ActionPersonalAPIKeyList); err != nil {
 			return nil, err
 		}
 

pkg/server/api/connect/v1/profile_resolvers.go

@@ -22,7 +22,7 @@ import (
 
 // CreateUser is the resolver for the createUser field.
 func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUserInput) (*types.CreateUserPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionMembershipProfileCreate); err != nil {
 		return nil, err
 	}
 
@@ -57,7 +57,7 @@ func (r *mutationResolver) CreateUser(ctx context.Context, input types.CreateUse
 
 // DeactivateUser is the resolver for the deactivateUser field.
 func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.DeactivateUserInput) (*types.DeactivateUserPayload, error) {
-	if err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate); err != nil {
+	if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate); err != nil {
 		return nil, err
 	}
 
@@ -78,7 +78,7 @@ func (r *mutationResolver) DeactivateUser(ctx context.Context, input types.Deact
 
 // UpdateUser is the resolver for the updateUser field.
 func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUserInput) (*types.UpdateUserPayload, error) {
-	if err := r.authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, iam.ActionMembershipProfileUpdate); err != nil {
 		return nil, err
 	}
 
@@ -106,7 +106,7 @@ func (r *mutationResolver) UpdateUser(ctx context.Context, input types.UpdateUse
 
 // RemoveUser is the resolver for the removeUser field.
 func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUserInput) (*types.RemoveUserPayload, error) {
-	if err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil {
+	if _, err := r.authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete); err != nil {
 		return nil, err
 	}
 
@@ -134,7 +134,7 @@ func (r *mutationResolver) RemoveUser(ctx context.Context, input types.RemoveUse
 
 // Identity is the resolver for the identity field.
 func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*types.Identity, error) {
-	if err := r.authorize(
+	if _, err := r.authorize(
 		ctx,
 		obj.ID,
 		iam.ActionMembershipProfileGet,
@@ -159,7 +159,7 @@ func (r *profileResolver) Identity(ctx context.Context, obj *types.Profile) (*ty
 
 // Organization is the resolver for the organization field.
 func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
+	if _, err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet, authz.WithSkipAssumptionCheck()); err != nil {
 		return nil, err
 	}
 
@@ -179,7 +179,7 @@ func (r *profileResolver) Organization(ctx context.Context, obj *types.Profile)
 
 // Membership is the resolver for the membership field.
 func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (*types.Membership, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipGet, authz.WithSkipAssumptionCheck()); err != nil {
 		return nil, err
 	}
 
@@ -199,7 +199,7 @@ func (r *profileResolver) Membership(ctx context.Context, obj *types.Profile) (*
 
 // PendingInvitations is the resolver for the pendingInvitations field.
 func (r *profileResolver) PendingInvitations(ctx context.Context, obj *types.Profile, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.InvitationOrderBy) (*types.InvitationConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionInvitationList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionInvitationList); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/resolver.go

@@ -116,7 +116,8 @@ func NewMux(
 }
 
 func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) {
-	return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil
+	_, err := r.authorize(ctx, obj.GetID(), action, authz.WithDryRun())
+	return err == nil, nil
 }
 
 func (r *Resolver) SSOLoginURL(samlConfigID gid.GID) string {

pkg/server/api/connect/v1/saml_resolvers.go

@@ -19,7 +19,7 @@ import (
 
 // CreateSAMLConfiguration is the resolver for the createSAMLConfiguration field.
 func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input types.CreateSAMLConfigurationInput) (*types.CreateSAMLConfigurationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationCreate); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationCreate); err != nil {
 		return nil, err
 	}
 
@@ -63,7 +63,7 @@ func (r *mutationResolver) CreateSAMLConfiguration(ctx context.Context, input ty
 
 // UpdateSAMLConfiguration is the resolver for the updateSAMLConfiguration field.
 func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input types.UpdateSAMLConfigurationInput) (*types.UpdateSAMLConfigurationPayload, error) {
-	if err := r.authorize(ctx, input.SamlConfigurationID, iam.ActionSAMLConfigurationUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.SamlConfigurationID, iam.ActionSAMLConfigurationUpdate); err != nil {
 		return nil, err
 	}
 
@@ -100,7 +100,7 @@ func (r *mutationResolver) UpdateSAMLConfiguration(ctx context.Context, input ty
 
 // DeleteSAMLConfiguration is the resolver for the deleteSAMLConfiguration field.
 func (r *mutationResolver) DeleteSAMLConfiguration(ctx context.Context, input types.DeleteSAMLConfigurationInput) (*types.DeleteSAMLConfigurationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationDelete); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSAMLConfigurationDelete); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/scim_resolvers.go

@@ -26,7 +26,7 @@ func (r *connectorResolver) Permission(ctx context.Context, obj *types.Connector
 
 // CreateSCIMConfiguration is the resolver for the createSCIMConfiguration field.
 func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input types.CreateSCIMConfigurationInput) (*types.CreateSCIMConfigurationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationCreate); err != nil {
 		return nil, err
 	}
 
@@ -59,7 +59,7 @@ func (r *mutationResolver) CreateSCIMConfiguration(ctx context.Context, input ty
 
 // DeleteSCIMConfiguration is the resolver for the deleteSCIMConfiguration field.
 func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input types.DeleteSCIMConfigurationInput) (*types.DeleteSCIMConfigurationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil {
+	if _, err := r.authorize(ctx, input.OrganizationID, iam.ActionSCIMConfigurationDelete); err != nil {
 		return nil, err
 	}
 
@@ -74,7 +74,7 @@ func (r *mutationResolver) DeleteSCIMConfiguration(ctx context.Context, input ty
 
 // RegenerateSCIMToken is the resolver for the regenerateSCIMToken field.
 func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.RegenerateSCIMTokenInput) (*types.RegenerateSCIMTokenPayload, error) {
-	if err := r.authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ScimConfigurationID, iam.ActionSCIMConfigurationUpdate); err != nil {
 		return nil, err
 	}
 
@@ -92,7 +92,7 @@ func (r *mutationResolver) RegenerateSCIMToken(ctx context.Context, input types.
 
 // UpdateSCIMBridge is the resolver for the updateSCIMBridge field.
 func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.UpdateSCIMBridgeInput) (*types.UpdateSCIMBridgePayload, error) {
-	if err := r.authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ScimBridgeID, iam.ActionSCIMBridgeUpdate); err != nil {
 		return nil, err
 	}
 
@@ -109,7 +109,7 @@ func (r *mutationResolver) UpdateSCIMBridge(ctx context.Context, input types.Upd
 
 // ScimConfiguration is the resolver for the scimConfiguration field.
 func (r *sCIMBridgeResolver) ScimConfiguration(ctx context.Context, obj *types.SCIMBridge) (*types.SCIMConfiguration, error) {
-	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
 		return nil, err
 	}
 
@@ -138,7 +138,7 @@ func (r *sCIMBridgeResolver) Connector(ctx context.Context, obj *types.SCIMBridg
 	}
 
 	// Authorize based on the SCIM configuration (connector accessed via bridge is a sub-resource)
-	if err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ScimConfiguration.ID, iam.ActionSCIMConfigurationGet); err != nil {
 		return nil, err
 	}
 
@@ -170,7 +170,7 @@ func (r *sCIMConfigurationResolver) EndpointURL(ctx context.Context, obj *types.
 
 // Organization is the resolver for the organization field.
 func (r *sCIMConfigurationResolver) Organization(ctx context.Context, obj *types.SCIMConfiguration) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.Organization.ID, iam.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -200,7 +200,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC
 		return nil, nil
 	}
 
-	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMConfigurationGet); err != nil {
 		return nil, err
 	}
 
@@ -220,7 +220,7 @@ func (r *sCIMConfigurationResolver) Bridge(ctx context.Context, obj *types.SCIMC
 
 // Events is the resolver for the events field.
 func (r *sCIMConfigurationResolver) Events(ctx context.Context, obj *types.SCIMConfiguration, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.SCIMEventOrderBy) (*types.SCIMEventConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionSCIMEventList); err != nil {
 		return nil, err
 	}
 
@@ -256,7 +256,7 @@ func (r *sCIMEventResolver) Permission(ctx context.Context, obj *types.SCIMEvent
 
 // TotalCount is the resolver for the totalCount field.
 func (r *sCIMEventConnectionResolver) TotalCount(ctx context.Context, obj *types.SCIMEventConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, iam.ActionSCIMEventList); err != nil {
+	if _, err := r.authorize(ctx, obj.ParentID, iam.ActionSCIMEventList); err != nil {
 		return nil, err
 	}
 

pkg/server/api/connect/v1/session_resolvers.go

@@ -416,7 +416,7 @@ func (r *mutationResolver) AssumeOrganizationSession(ctx context.Context, input
 
 // RevokeSession is the resolver for the revokeSession field.
 func (r *mutationResolver) RevokeSession(ctx context.Context, input types.RevokeSessionInput) (*types.RevokeSessionPayload, error) {
-	if err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil {
+	if _, err := r.authorize(ctx, input.SessionID, iam.ActionSessionRevoke); err != nil {
 		return nil, err
 	}
 
@@ -438,7 +438,7 @@ func (r *mutationResolver) RevokeSession(ctx context.Context, input types.Revoke
 
 // RevokeAllSessions is the resolver for the revokeAllSessions field.
 func (r *mutationResolver) RevokeAllSessions(ctx context.Context) (*types.RevokeAllSessionsPayload, error) {
-	if err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil {
+	if _, err := r.authorize(ctx, authn.SessionFromContext(ctx).ID, iam.ActionSessionRevokeAll); err != nil {
 		return nil, err
 	}
 

pkg/server/api/console/v1/access_review_campaign_resolvers.go

@@ -23,12 +23,11 @@ import (
 
 // Campaign is the resolver for the campaign field.
 func (r *accessEntryResolver) Campaign(ctx context.Context, obj *types.AccessEntry) (*types.AccessReviewCampaign, error) {
-	if err := r.authorize(ctx, obj.Campaign.ID, probo.ActionAccessReviewCampaignGet); err != nil {
+	scope, err := r.authorize(ctx, obj.Campaign.ID, probo.ActionAccessReviewCampaignGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.Campaign.ID)
-
 	campaign, err := r.accessReview.Campaigns(scope).Get(ctx, obj.Campaign.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -43,12 +42,11 @@ func (r *accessEntryResolver) Campaign(ctx context.Context, obj *types.AccessEnt
 
 // AccessSource is the resolver for the accessSource field.
 func (r *accessEntryResolver) AccessSource(ctx context.Context, obj *types.AccessEntry) (*types.AccessSource, error) {
-	if err := r.authorize(ctx, obj.AccessSource.ID, probo.ActionAccessSourceGet); err != nil {
+	scope, err := r.authorize(ctx, obj.AccessSource.ID, probo.ActionAccessSourceGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.AccessSource.ID)
-
 	source, err := r.accessReview.Sources(scope).Get(ctx, obj.AccessSource.ID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -63,12 +61,11 @@ func (r *accessEntryResolver) AccessSource(ctx context.Context, obj *types.Acces
 
 // DecisionHistory is the resolver for the decisionHistory field.
 func (r *accessEntryResolver) DecisionHistory(ctx context.Context, obj *types.AccessEntry) ([]*types.AccessEntryDecisionHistoryEntry, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	histories, err := r.accessReview.Entries(scope).DecisionHistory(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot get decision history: %w", err))
@@ -125,12 +122,11 @@ func (r *accessReviewResolver) IdentitySource(ctx context.Context, obj *types.Ac
 
 // AccessSources is the resolver for the accessSources field.
 func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) {
-	if err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList); err != nil {
+	scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessSourceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.Organization.ID)
-
 	pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{
 		Field:     coredata.AccessSourceOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -154,12 +150,11 @@ func (r *accessReviewResolver) AccessSources(ctx context.Context, obj *types.Acc
 
 // Campaigns is the resolver for the campaigns field.
 func (r *accessReviewResolver) Campaigns(ctx context.Context, obj *types.AccessReview, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) {
-	if err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList); err != nil {
+	scope, err := r.authorize(ctx, obj.Organization.ID, probo.ActionAccessReviewCampaignList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.Organization.ID)
-
 	pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{
 		Field:     coredata.AccessReviewCampaignOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -193,12 +188,11 @@ func (r *accessReviewCampaignResolver) Organization(ctx context.Context, obj *ty
 
 // ScopeSources is the resolver for the scopeSources field.
 func (r *accessReviewCampaignResolver) ScopeSources(ctx context.Context, obj *types.AccessReviewCampaign) ([]*types.AccessReviewCampaignScopeSource, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	sources, err := r.accessReview.Sources(scope).ListScopeSourcesForCampaignID(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot list scope sources: %w", err))
@@ -224,12 +218,11 @@ func (r *accessReviewCampaignResolver) ScopeSources(ctx context.Context, obj *ty
 
 // Entries is the resolver for the entries field.
 func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.AccessReviewCampaign, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessEntryOrder, accessSourceID *gid.GID, filter *coredata.AccessEntryFilter) (*types.AccessEntryConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{
 		Field:     coredata.AccessEntryOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -244,8 +237,7 @@ func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.A
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
 	var (
-		p   *page.Page[*coredata.AccessEntry, coredata.AccessEntryOrderField]
-		err error
+		p *page.Page[*coredata.AccessEntry, coredata.AccessEntryOrderField]
 	)
 
 	if accessSourceID != nil {
@@ -263,12 +255,11 @@ func (r *accessReviewCampaignResolver) Entries(ctx context.Context, obj *types.A
 
 // PendingEntryCount is the resolver for the pendingEntryCount field.
 func (r *accessReviewCampaignResolver) PendingEntryCount(ctx context.Context, obj *types.AccessReviewCampaign) (int, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	count, err := r.accessReview.Entries(scope).CountPendingForCampaignID(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot count pending access entries: %w", err))
@@ -279,12 +270,11 @@ func (r *accessReviewCampaignResolver) PendingEntryCount(ctx context.Context, ob
 
 // Statistics is the resolver for the statistics field.
 func (r *accessReviewCampaignResolver) Statistics(ctx context.Context, obj *types.AccessReviewCampaign) (*types.AccessReviewCampaignStatistics, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessEntryList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	stats, err := r.accessReview.Entries(scope).Statistics(ctx, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot get campaign statistics: %w", err))
@@ -317,12 +307,11 @@ func (r *accessReviewCampaignConnectionResolver) TotalCount(ctx context.Context,
 
 // Entries is the resolver for the entries field.
 func (r *accessReviewCampaignScopeSourceResolver) Entries(ctx context.Context, obj *types.AccessReviewCampaignScopeSource, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessEntryOrder, filter *coredata.AccessEntryFilter) (*types.AccessEntryConnection, error) {
-	if err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList); err != nil {
+	scope, err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.CampaignID)
-
 	pageOrderBy := page.OrderBy[coredata.AccessEntryOrderField]{
 		Field:     coredata.AccessEntryOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -348,12 +337,11 @@ func (r *accessReviewCampaignScopeSourceResolver) Entries(ctx context.Context, o
 
 // Statistics is the resolver for the statistics field.
 func (r *accessReviewCampaignScopeSourceResolver) Statistics(ctx context.Context, obj *types.AccessReviewCampaignScopeSource) (*types.AccessReviewCampaignStatistics, error) {
-	if err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList); err != nil {
+	scope, err := r.authorize(ctx, obj.CampaignID, probo.ActionAccessEntryList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.CampaignID)
-
 	stats, err := r.accessReview.Entries(scope).StatisticsForSource(ctx, obj.CampaignID, obj.ID)
 	if err != nil {
 		panic(fmt.Errorf("cannot get source statistics: %w", err))
@@ -390,7 +378,8 @@ func (r *accessSourceResolver) Connector(ctx context.Context, obj *types.AccessS
 
 // ProviderOrganizations is the resolver for the providerOrganizations field.
 func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *types.AccessSource) ([]*types.ProviderOrganization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
+	if err != nil {
 		return nil, err
 	}
 
@@ -398,8 +387,6 @@ func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *t
 		return []*types.ProviderOrganization{}, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	httpClient, dbConnector, err := r.accessReview.Sources(scope).ConnectorHTTPClient(ctx, *obj.ConnectorID)
 	if err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
@@ -434,7 +421,8 @@ func (r *accessSourceResolver) ProviderOrganizations(ctx context.Context, obj *t
 // return false: the identifier is captured during the OAuth callback,
 // not via a follow-up configure mutation.
 func (r *accessSourceResolver) NeedsConfiguration(ctx context.Context, obj *types.AccessSource) (bool, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
+	if err != nil {
 		return false, err
 	}
 
@@ -442,7 +430,6 @@ func (r *accessSourceResolver) NeedsConfiguration(ctx context.Context, obj *type
 		return false, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	dbConnector, err := prb.Connectors.Get(ctx, scope, *obj.ConnectorID)
@@ -496,7 +483,8 @@ func (r *accessSourceResolver) ConnectionStatus(ctx context.Context, obj *types.
 
 // SelectedOrganization is the resolver for the selectedOrganization field.
 func (r *accessSourceResolver) SelectedOrganization(ctx context.Context, obj *types.AccessSource) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceGet)
+	if err != nil {
 		return nil, err
 	}
 
@@ -504,7 +492,6 @@ func (r *accessSourceResolver) SelectedOrganization(ctx context.Context, obj *ty
 		return nil, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	dbConnector, err := prb.Connectors.Get(ctx, scope, *obj.ConnectorID)
@@ -553,12 +540,11 @@ func (r *accessSourceConnectionResolver) TotalCount(ctx context.Context, obj *ty
 
 // CreateAccessSource is the resolver for the createAccessSource field.
 func (r *mutationResolver) CreateAccessSource(ctx context.Context, input types.CreateAccessSourceInput) (*types.CreateAccessSourcePayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessSourceCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
-
 	source, err := r.accessReview.Sources(scope).Create(ctx, accessreview.CreateAccessSourceRequest{
 		OrganizationID: input.OrganizationID,
 		ConnectorID:    input.ConnectorID,
@@ -577,12 +563,11 @@ func (r *mutationResolver) CreateAccessSource(ctx context.Context, input types.C
 
 // UpdateAccessSource is the resolver for the updateAccessSource field.
 func (r *mutationResolver) UpdateAccessSource(ctx context.Context, input types.UpdateAccessSourceInput) (*types.UpdateAccessSourcePayload, error) {
-	if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessSourceID)
-
 	req := accessreview.UpdateAccessSourceRequest{
 		AccessSourceID: input.AccessSourceID,
 	}
@@ -614,12 +599,11 @@ func (r *mutationResolver) UpdateAccessSource(ctx context.Context, input types.U
 
 // DeleteAccessSource is the resolver for the deleteAccessSource field.
 func (r *mutationResolver) DeleteAccessSource(ctx context.Context, input types.DeleteAccessSourceInput) (*types.DeleteAccessSourcePayload, error) {
-	if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete); err != nil {
+	scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessSourceID)
-
 	if err := r.accessReview.Sources(scope).Delete(ctx, input.AccessSourceID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -635,12 +619,11 @@ func (r *mutationResolver) DeleteAccessSource(ctx context.Context, input types.D
 
 // ConfigureAccessSource is the resolver for the configureAccessSource field.
 func (r *mutationResolver) ConfigureAccessSource(ctx context.Context, input types.ConfigureAccessSourceInput) (*types.ConfigureAccessSourcePayload, error) {
-	if err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.AccessSourceID, probo.ActionAccessSourceUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessSourceID)
-
 	source, err := r.accessReview.Sources(scope).ConfigureAccessSource(
 		ctx,
 		accessreview.ConfigureAccessSourceRequest{
@@ -663,12 +646,11 @@ func (r *mutationResolver) ConfigureAccessSource(ctx context.Context, input type
 
 // CreateAccessReviewCampaign is the resolver for the createAccessReviewCampaign field.
 func (r *mutationResolver) CreateAccessReviewCampaign(ctx context.Context, input types.CreateAccessReviewCampaignInput) (*types.CreateAccessReviewCampaignPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAccessReviewCampaignCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
-
 	var description string
 	if input.Description != nil {
 		description = *input.Description
@@ -692,12 +674,11 @@ func (r *mutationResolver) CreateAccessReviewCampaign(ctx context.Context, input
 
 // UpdateAccessReviewCampaign is the resolver for the updateAccessReviewCampaign field.
 func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input types.UpdateAccessReviewCampaignInput) (*types.UpdateAccessReviewCampaignPayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	req := accessreview.UpdateAccessReviewCampaignRequest{
 		CampaignID: input.AccessReviewCampaignID,
 	}
@@ -730,12 +711,11 @@ func (r *mutationResolver) UpdateAccessReviewCampaign(ctx context.Context, input
 
 // DeleteAccessReviewCampaign is the resolver for the deleteAccessReviewCampaign field.
 func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input types.DeleteAccessReviewCampaignInput) (*types.DeleteAccessReviewCampaignPayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignDelete); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	if err := r.accessReview.Campaigns(scope).Delete(ctx, input.AccessReviewCampaignID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -751,12 +731,11 @@ func (r *mutationResolver) DeleteAccessReviewCampaign(ctx context.Context, input
 
 // StartAccessReviewCampaign is the resolver for the startAccessReviewCampaign field.
 func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input types.StartAccessReviewCampaignInput) (*types.StartAccessReviewCampaignPayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignStart); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignStart)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	campaign, err := r.accessReview.Campaigns(scope).Start(ctx, input.AccessReviewCampaignID)
 	if err != nil {
 		panic(fmt.Errorf("cannot start access review campaign: %w", err))
@@ -769,12 +748,11 @@ func (r *mutationResolver) StartAccessReviewCampaign(ctx context.Context, input
 
 // CloseAccessReviewCampaign is the resolver for the closeAccessReviewCampaign field.
 func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input types.CloseAccessReviewCampaignInput) (*types.CloseAccessReviewCampaignPayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignClose); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignClose)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	campaign, err := r.accessReview.Campaigns(scope).Close(ctx, input.AccessReviewCampaignID)
 	if err != nil {
 		panic(fmt.Errorf("cannot close access review campaign: %w", err))
@@ -787,12 +765,11 @@ func (r *mutationResolver) CloseAccessReviewCampaign(ctx context.Context, input
 
 // CancelAccessReviewCampaign is the resolver for the cancelAccessReviewCampaign field.
 func (r *mutationResolver) CancelAccessReviewCampaign(ctx context.Context, input types.CancelAccessReviewCampaignInput) (*types.CancelAccessReviewCampaignPayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignCancel); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignCancel)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	campaign, err := r.accessReview.Campaigns(scope).Cancel(ctx, input.AccessReviewCampaignID)
 	if err != nil {
 		panic(fmt.Errorf("cannot cancel access review campaign: %w", err))
@@ -805,12 +782,11 @@ func (r *mutationResolver) CancelAccessReviewCampaign(ctx context.Context, input
 
 // AddAccessReviewCampaignScopeSource is the resolver for the addAccessReviewCampaignScopeSource field.
 func (r *mutationResolver) AddAccessReviewCampaignScopeSource(ctx context.Context, input types.AddAccessReviewCampaignScopeSourceInput) (*types.AddAccessReviewCampaignScopeSourcePayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignAddScopeSource); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignAddScopeSource)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	campaign, err := r.accessReview.Campaigns(scope).AddScopeSource(ctx, accessreview.AddCampaignScopeSourceRequest{
 		CampaignID:     input.AccessReviewCampaignID,
 		AccessSourceID: input.AccessSourceID,
@@ -826,12 +802,11 @@ func (r *mutationResolver) AddAccessReviewCampaignScopeSource(ctx context.Contex
 
 // RemoveAccessReviewCampaignScopeSource is the resolver for the removeAccessReviewCampaignScopeSource field.
 func (r *mutationResolver) RemoveAccessReviewCampaignScopeSource(ctx context.Context, input types.RemoveAccessReviewCampaignScopeSourceInput) (*types.RemoveAccessReviewCampaignScopeSourcePayload, error) {
-	if err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource); err != nil {
+	scope, err := r.authorize(ctx, input.AccessReviewCampaignID, probo.ActionAccessReviewCampaignRemoveScopeSource)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessReviewCampaignID)
-
 	campaign, err := r.accessReview.Campaigns(scope).RemoveScopeSource(ctx, accessreview.RemoveCampaignScopeSourceRequest{
 		CampaignID:     input.AccessReviewCampaignID,
 		AccessSourceID: input.AccessSourceID,
@@ -847,12 +822,11 @@ func (r *mutationResolver) RemoveAccessReviewCampaignScopeSource(ctx context.Con
 
 // RecordAccessEntryDecision is the resolver for the recordAccessEntryDecision field.
 func (r *mutationResolver) RecordAccessEntryDecision(ctx context.Context, input types.RecordAccessEntryDecisionInput) (*types.RecordAccessEntryDecisionPayload, error) {
-	if err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide); err != nil {
+	scope, err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryDecide)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessEntryID)
-
 	// Resolve the profile ID from the session's identity.
 	// The profile may not exist for every identity, in which
 	// case decided_by will be left nil.
@@ -904,7 +878,8 @@ func (r *mutationResolver) RecordAccessEntryDecisions(ctx context.Context, input
 
 	// Authorize each entry individually to prevent cross-org bypass.
 	for _, d := range input.Decisions {
-		if err := r.authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide); err != nil {
+		_, err := r.authorize(ctx, d.AccessEntryID, probo.ActionAccessEntryDecide)
+		if err != nil {
 			return nil, err
 		}
 	}
@@ -968,12 +943,11 @@ func (r *mutationResolver) RecordAccessEntryDecisions(ctx context.Context, input
 
 // FlagAccessEntry is the resolver for the flagAccessEntry field.
 func (r *mutationResolver) FlagAccessEntry(ctx context.Context, input types.FlagAccessEntryInput) (*types.FlagAccessEntryPayload, error) {
-	if err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag); err != nil {
+	scope, err := r.authorize(ctx, input.AccessEntryID, probo.ActionAccessEntryFlag)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AccessEntryID)
-
 	entry, err := r.accessReview.Entries(scope).FlagEntry(ctx, accessreview.FlagAccessEntryRequest{
 		EntryID:     input.AccessEntryID,
 		Flags:       input.Flags,

pkg/server/api/console/v1/asset_resolvers.go

@@ -25,7 +25,7 @@ import (
 
 // Owner is the resolver for the owner field.
 func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -47,11 +47,11 @@ func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Pro
 
 // ThirdParties is the resolver for the thirdParties field.
 func (r *assetResolver) ThirdParties(ctx context.Context, obj *types.Asset, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
@@ -78,11 +78,11 @@ func (r *assetResolver) ThirdParties(ctx context.Context, obj *types.Asset, firs
 
 // Organization is the resolver for the organization field.
 func (r *assetResolver) Organization(ctx context.Context, obj *types.Asset) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	asset, err := prb.Assets.Get(ctx, scope, obj.ID)
@@ -112,11 +112,11 @@ func (r *assetResolver) Permission(ctx context.Context, obj *types.Asset, action
 
 // TotalCount is the resolver for the totalCount field.
 func (r *assetConnectionResolver) TotalCount(ctx context.Context, obj *types.AssetConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionAssetList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAssetList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -137,7 +137,7 @@ func (r *assetConnectionResolver) TotalCount(ctx context.Context, obj *types.Ass
 
 // Owner is the resolver for the owner field.
 func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -157,11 +157,11 @@ func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Pro
 
 // ThirdParties is the resolver for the thirdParties field.
 func (r *datumResolver) ThirdParties(ctx context.Context, obj *types.Datum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
@@ -188,7 +188,7 @@ func (r *datumResolver) ThirdParties(ctx context.Context, obj *types.Datum, firs
 
 // Organization is the resolver for the organization field.
 func (r *datumResolver) Organization(ctx context.Context, obj *types.Datum) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -215,11 +215,11 @@ func (r *datumResolver) Permission(ctx context.Context, obj *types.Datum, action
 
 // TotalCount is the resolver for the totalCount field.
 func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.DatumConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDatumList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDatumList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -240,11 +240,11 @@ func (r *datumConnectionResolver) TotalCount(ctx context.Context, obj *types.Dat
 
 // CreateAsset is the resolver for the createAsset field.
 func (r *mutationResolver) CreateAsset(ctx context.Context, input types.CreateAssetInput) (*types.CreateAssetPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	asset, err := prb.Assets.Create(
@@ -276,11 +276,11 @@ func (r *mutationResolver) CreateAsset(ctx context.Context, input types.CreateAs
 
 // UpdateAsset is the resolver for the updateAsset field.
 func (r *mutationResolver) UpdateAsset(ctx context.Context, input types.UpdateAssetInput) (*types.UpdateAssetPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionAssetUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionAssetUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	asset, err := prb.Assets.Update(
@@ -312,15 +312,14 @@ func (r *mutationResolver) UpdateAsset(ctx context.Context, input types.UpdateAs
 
 // DeleteAsset is the resolver for the deleteAsset field.
 func (r *mutationResolver) DeleteAsset(ctx context.Context, input types.DeleteAssetInput) (*types.DeleteAssetPayload, error) {
-	if err := r.authorize(ctx, input.AssetID, probo.ActionAssetDelete); err != nil {
+	scope, err := r.authorize(ctx, input.AssetID, probo.ActionAssetDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AssetID)
 	prb := r.probo
 
-	err := prb.Assets.Delete(ctx, scope, input.AssetID)
-	if err != nil {
+	if err := prb.Assets.Delete(ctx, scope, input.AssetID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete asset", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -332,11 +331,11 @@ func (r *mutationResolver) DeleteAsset(ctx context.Context, input types.DeleteAs
 
 // CreateDatum is the resolver for the createDatum field.
 func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDatumInput) (*types.CreateDatumPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	data, err := prb.Data.Create(
@@ -366,11 +365,11 @@ func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDa
 
 // UpdateDatum is the resolver for the updateDatum field.
 func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDatumInput) (*types.UpdateDatumPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionDatumUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionDatumUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	datum, err := prb.Data.Update(
@@ -400,11 +399,11 @@ func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDa
 
 // DeleteDatum is the resolver for the deleteDatum field.
 func (r *mutationResolver) DeleteDatum(ctx context.Context, input types.DeleteDatumInput) (*types.DeleteDatumPayload, error) {
-	if err := r.authorize(ctx, input.DatumID, probo.ActionDatumDelete); err != nil {
+	scope, err := r.authorize(ctx, input.DatumID, probo.ActionDatumDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DatumID)
 	prb := r.probo
 
 	if err := prb.Data.Delete(ctx, scope, input.DatumID); err != nil {
@@ -419,11 +418,11 @@ func (r *mutationResolver) DeleteDatum(ctx context.Context, input types.DeleteDa
 
 // PublishDataList is the resolver for the publishDataList field.
 func (r *mutationResolver) PublishDataList(ctx context.Context, input types.PublishDataListInput) (*types.PublishDataListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDatumPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishDataList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -449,11 +448,11 @@ func (r *mutationResolver) PublishDataList(ctx context.Context, input types.Publ
 
 // PublishAssetList is the resolver for the publishAssetList field.
 func (r *mutationResolver) PublishAssetList(ctx context.Context, input types.PublishAssetListInput) (*types.PublishAssetListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAssetPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishAssetList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)

pkg/server/api/console/v1/audit_resolvers.go

@@ -26,7 +26,7 @@ import (
 
 // Organization is the resolver for the organization field.
 func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -48,7 +48,7 @@ func (r *auditResolver) Organization(ctx context.Context, obj *types.Audit) (*ty
 
 // Framework is the resolver for the framework field.
 func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types.Framework, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
 		return nil, err
 	}
 
@@ -70,7 +70,7 @@ func (r *auditResolver) Framework(ctx context.Context, obj *types.Audit) (*types
 
 // Report is the resolver for the report field.
 func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Report, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionReportGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionReportGet); err != nil {
 		return nil, err
 	}
 
@@ -96,7 +96,8 @@ func (r *auditResolver) Report(ctx context.Context, obj *types.Audit) (*types.Re
 
 // ReportURL is the resolver for the reportUrl field.
 func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionReportGetReportUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionReportGetReportUrl)
+	if err != nil {
 		return nil, err
 	}
 
@@ -104,7 +105,6 @@ func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*strin
 		return nil, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	url, err := prb.Audits.GenerateReportURL(ctx, scope, obj.ID, 15*time.Minute)
@@ -118,11 +118,11 @@ func (r *auditResolver) ReportURL(ctx context.Context, obj *types.Audit) (*strin
 
 // Controls is the resolver for the controls field.
 func (r *auditResolver) Controls(ctx context.Context, obj *types.Audit, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
@@ -154,11 +154,11 @@ func (r *auditResolver) Controls(ctx context.Context, obj *types.Audit, first *i
 
 // Findings is the resolver for the findings field.
 func (r *auditResolver) Findings(ctx context.Context, obj *types.Audit, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FindingOrder, filter *types.FindingFilter) (*types.FindingConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFindingList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFindingList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.FindingOrderField]{
@@ -205,11 +205,11 @@ func (r *auditResolver) Permission(ctx context.Context, obj *types.Audit, action
 
 // TotalCount is the resolver for the totalCount field.
 func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.AuditConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionAuditList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionAuditList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -245,7 +245,7 @@ func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.Aud
 
 // Organization is the resolver for the organization field.
 func (r *findingResolver) Organization(ctx context.Context, obj *types.Finding) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -267,11 +267,11 @@ func (r *findingResolver) Organization(ctx context.Context, obj *types.Finding)
 
 // Audits is the resolver for the audits field.
 func (r *findingResolver) Audits(ctx context.Context, obj *types.Finding, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAuditList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.AuditOrderField]{
@@ -302,7 +302,7 @@ func (r *findingResolver) Owner(ctx context.Context, obj *types.Finding) (*types
 		return nil, nil
 	}
 
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -328,7 +328,7 @@ func (r *findingResolver) Risk(ctx context.Context, obj *types.Finding) (*types.
 		return nil, nil
 	}
 
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionRiskGet); err != nil {
 		return nil, err
 	}
 
@@ -355,11 +355,11 @@ func (r *findingResolver) Permission(ctx context.Context, obj *types.Finding, ac
 
 // TotalCount is the resolver for the totalCount field.
 func (r *findingConnectionResolver) TotalCount(ctx context.Context, obj *types.FindingConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionFindingList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionFindingList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	var (
@@ -403,11 +403,11 @@ func (r *findingConnectionResolver) TotalCount(ctx context.Context, obj *types.F
 
 // CreateAudit is the resolver for the createAudit field.
 func (r *mutationResolver) CreateAudit(ctx context.Context, input types.CreateAuditInput) (*types.CreateAuditPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionAuditCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionAuditCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.CreateAuditRequest{
@@ -461,11 +461,11 @@ func (r *mutationResolver) CreateAudit(ctx context.Context, input types.CreateAu
 
 // UpdateAudit is the resolver for the updateAudit field.
 func (r *mutationResolver) UpdateAudit(ctx context.Context, input types.UpdateAuditInput) (*types.UpdateAuditPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionAuditUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionAuditUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateAuditRequest{
@@ -495,15 +495,14 @@ func (r *mutationResolver) UpdateAudit(ctx context.Context, input types.UpdateAu
 
 // DeleteAudit is the resolver for the deleteAudit field.
 func (r *mutationResolver) DeleteAudit(ctx context.Context, input types.DeleteAuditInput) (*types.DeleteAuditPayload, error) {
-	if err := r.authorize(ctx, input.AuditID, probo.ActionAuditDelete); err != nil {
+	scope, err := r.authorize(ctx, input.AuditID, probo.ActionAuditDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AuditID)
 	prb := r.probo
 
-	err := prb.Audits.Delete(ctx, scope, input.AuditID)
-	if err != nil {
+	if err := prb.Audits.Delete(ctx, scope, input.AuditID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete audit", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -515,11 +514,11 @@ func (r *mutationResolver) DeleteAudit(ctx context.Context, input types.DeleteAu
 
 // UploadAuditReport is the resolver for the uploadAuditReport field.
 func (r *mutationResolver) UploadAuditReport(ctx context.Context, input types.UploadAuditReportInput) (*types.UploadAuditReportPayload, error) {
-	if err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportUpload); err != nil {
+	scope, err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportUpload)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AuditID)
 	prb := r.probo
 
 	req := probo.UploadAuditReportRequest{
@@ -550,11 +549,11 @@ func (r *mutationResolver) UploadAuditReport(ctx context.Context, input types.Up
 
 // DeleteAuditReport is the resolver for the deleteAuditReport field.
 func (r *mutationResolver) DeleteAuditReport(ctx context.Context, input types.DeleteAuditReportInput) (*types.DeleteAuditReportPayload, error) {
-	if err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportDelete); err != nil {
+	scope, err := r.authorize(ctx, input.AuditID, probo.ActionAuditReportDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AuditID)
 	prb := r.probo
 
 	audit, err := prb.Audits.DeleteReport(ctx, scope, input.AuditID)
@@ -570,11 +569,11 @@ func (r *mutationResolver) DeleteAuditReport(ctx context.Context, input types.De
 
 // CreateFinding is the resolver for the createFinding field.
 func (r *mutationResolver) CreateFinding(ctx context.Context, input types.CreateFindingInput) (*types.CreateFindingPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.CreateFindingRequest{
@@ -611,11 +610,11 @@ func (r *mutationResolver) CreateFinding(ctx context.Context, input types.Create
 
 // UpdateFinding is the resolver for the updateFinding field.
 func (r *mutationResolver) UpdateFinding(ctx context.Context, input types.UpdateFindingInput) (*types.UpdateFindingPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionFindingUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionFindingUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateFindingRequest{
@@ -651,15 +650,14 @@ func (r *mutationResolver) UpdateFinding(ctx context.Context, input types.Update
 
 // DeleteFinding is the resolver for the deleteFinding field.
 func (r *mutationResolver) DeleteFinding(ctx context.Context, input types.DeleteFindingInput) (*types.DeleteFindingPayload, error) {
-	if err := r.authorize(ctx, input.FindingID, probo.ActionFindingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.FindingID, probo.ActionFindingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.FindingID)
 	prb := r.probo
 
-	err := prb.Findings.Delete(ctx, scope, input.FindingID)
-	if err != nil {
+	if err := prb.Findings.Delete(ctx, scope, input.FindingID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete finding", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -671,11 +669,11 @@ func (r *mutationResolver) DeleteFinding(ctx context.Context, input types.Delete
 
 // CreateFindingAuditMapping is the resolver for the createFindingAuditMapping field.
 func (r *mutationResolver) CreateFindingAuditMapping(ctx context.Context, input types.CreateFindingAuditMappingInput) (*types.CreateFindingAuditMappingPayload, error) {
-	if err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.FindingID)
 	prb := r.probo
 
 	finding, audit, err := prb.Findings.CreateAuditMapping(ctx, scope, input.FindingID, input.AuditID, input.ReferenceID)
@@ -692,11 +690,11 @@ func (r *mutationResolver) CreateFindingAuditMapping(ctx context.Context, input
 
 // DeleteFindingAuditMapping is the resolver for the deleteFindingAuditMapping field.
 func (r *mutationResolver) DeleteFindingAuditMapping(ctx context.Context, input types.DeleteFindingAuditMappingInput) (*types.DeleteFindingAuditMappingPayload, error) {
-	if err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.FindingID, probo.ActionFindingAuditMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.FindingID)
 	prb := r.probo
 
 	finding, audit, err := prb.Findings.DeleteAuditMapping(ctx, scope, input.FindingID, input.AuditID)
@@ -713,11 +711,11 @@ func (r *mutationResolver) DeleteFindingAuditMapping(ctx context.Context, input
 
 // PublishFindingList is the resolver for the publishFindingList field.
 func (r *mutationResolver) PublishFindingList(ctx context.Context, input types.PublishFindingListInput) (*types.PublishFindingListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFindingPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishFindingList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -743,11 +741,11 @@ func (r *mutationResolver) PublishFindingList(ctx context.Context, input types.P
 
 // DownloadURL is the resolver for the downloadUrl field.
 func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionReportDownloadUrlGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionReportDownloadUrlGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	url, err := prb.Reports.GenerateDownloadURL(ctx, scope, obj.ID, 15*time.Minute)
@@ -761,11 +759,11 @@ func (r *reportResolver) DownloadURL(ctx context.Context, obj *types.Report) (*s
 
 // Audit is the resolver for the audit field.
 func (r *reportResolver) Audit(ctx context.Context, obj *types.Report) (*types.Audit, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAuditGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	audit, err := prb.Audits.GetByReportID(ctx, scope, obj.ID)

pkg/server/api/console/v1/base_resolvers.go

@@ -498,7 +498,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 	default:
 	}
 
-	if err := r.authorize(ctx, id, action); err != nil {
+	if _, err := r.authorize(ctx, id, action); err != nil {
 		return nil, err
 	}
 

pkg/server/api/console/v1/connector_initiate.go

@@ -72,18 +72,18 @@ func handleConnectorInitiate(
 			return
 		}
 
-		if err := iamSvc.Authorizer.Authorize(r.Context(), iam.AuthorizeParams{
+		scope, err := iamSvc.Authorizer.Authorize(r.Context(), iam.AuthorizeParams{
 			Principal: identity.ID,
 			Resource:  organizationID,
 			Session:   &session.ID,
 			Action:    probo.ActionConnectorInitiate,
-		}); err != nil {
+		})
+		if err != nil {
 			httpserver.RenderError(w, http.StatusForbidden, err)
 			return
 		}
 
 		requestedScopes := r.URL.Query()["scope"]
-		scope := coredata.NewScopeFromObjectID(organizationID)
 		prb := proboSvc
 
 		// Look up any existing connector so we can union its stored scopes

pkg/server/api/console/v1/connector_resolvers.go

@@ -32,11 +32,11 @@ func (r *connectorResolver) Oauth2Scopes(ctx context.Context, obj *types.Connect
 
 // CreateAPIKeyConnector is the resolver for the createAPIKeyConnector field.
 func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input types.CreateAPIKeyConnectorInput) (*types.CreateAPIKeyConnectorPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.CreateConnectorRequest{
@@ -92,11 +92,11 @@ func (r *mutationResolver) CreateAPIKeyConnector(ctx context.Context, input type
 
 // CreateClientCredentialsConnector is the resolver for the createClientCredentialsConnector field.
 func (r *mutationResolver) CreateClientCredentialsConnector(ctx context.Context, input types.CreateClientCredentialsConnectorInput) (*types.CreateClientCredentialsConnectorPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionConnectorCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	oauth2Conn := &connector.OAuth2Connection{
@@ -139,11 +139,11 @@ func (r *mutationResolver) CreateClientCredentialsConnector(ctx context.Context,
 
 // DeleteConnector is the resolver for the deleteConnector field.
 func (r *mutationResolver) DeleteConnector(ctx context.Context, input types.DeleteConnectorInput) (*types.DeleteConnectorPayload, error) {
-	if err := r.authorize(ctx, input.ConnectorID, probo.ActionConnectorDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ConnectorID, probo.ActionConnectorDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ConnectorID)
 	prb := r.probo
 
 	if err := prb.Connectors.Delete(ctx, scope, input.ConnectorID); err != nil {
@@ -157,15 +157,14 @@ func (r *mutationResolver) DeleteConnector(ctx context.Context, input types.Dele
 
 // DeleteSlackConnection is the resolver for the deleteSlackConnection field.
 func (r *mutationResolver) DeleteSlackConnection(ctx context.Context, input types.DeleteSlackConnectionInput) (*types.DeleteSlackConnectionPayload, error) {
-	if err := r.authorize(ctx, input.SlackConnectionID, probo.ActionConnectorDelete); err != nil {
+	scope, err := r.authorize(ctx, input.SlackConnectionID, probo.ActionConnectorDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.SlackConnectionID)
 	prb := r.probo
 
-	err := prb.Connectors.Delete(ctx, scope, input.SlackConnectionID)
-	if err != nil {
+	if err := prb.Connectors.Delete(ctx, scope, input.SlackConnectionID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete slack connection", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}

pkg/server/api/console/v1/control_resolvers.go

@@ -24,11 +24,11 @@ import (
 
 // StatementOfApplicability is the resolver for the statementOfApplicability field.
 func (r *applicabilityStatementResolver) StatementOfApplicability(ctx context.Context, obj *types.ApplicabilityStatement) (*types.StatementOfApplicability, error) {
-	if err := r.authorize(ctx, obj.StatementOfApplicability.ID, probo.ActionStatementOfApplicabilityGet); err != nil {
+	scope, err := r.authorize(ctx, obj.StatementOfApplicability.ID, probo.ActionStatementOfApplicabilityGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.StatementOfApplicability.ID)
 	prb := r.probo
 
 	soa, err := prb.StatementsOfApplicability.Get(ctx, scope, obj.StatementOfApplicability.ID)
@@ -42,7 +42,7 @@ func (r *applicabilityStatementResolver) StatementOfApplicability(ctx context.Co
 
 // Control is the resolver for the control field.
 func (r *applicabilityStatementResolver) Control(ctx context.Context, obj *types.ApplicabilityStatement) (*types.Control, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionControlGet); err != nil {
 		return nil, err
 	}
 
@@ -69,11 +69,11 @@ func (r *applicabilityStatementResolver) Permission(ctx context.Context, obj *ty
 
 // TotalCount is the resolver for the totalCount field.
 func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Context, obj *types.ApplicabilityStatementConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionApplicabilityStatementList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionApplicabilityStatementList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -94,7 +94,7 @@ func (r *applicabilityStatementConnectionResolver) TotalCount(ctx context.Contex
 
 // Organization is the resolver for the organization field.
 func (r *controlResolver) Organization(ctx context.Context, obj *types.Control) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -158,7 +158,7 @@ func (r *controlResolver) RiskAssessment(ctx context.Context, obj *types.Control
 
 // Framework is the resolver for the framework field.
 func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*types.Framework, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
 		return nil, err
 	}
 
@@ -180,11 +180,11 @@ func (r *controlResolver) Framework(ctx context.Context, obj *types.Control) (*t
 
 // Measures is the resolver for the measures field.
 func (r *controlResolver) Measures(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{
@@ -216,11 +216,11 @@ func (r *controlResolver) Measures(ctx context.Context, obj *types.Control, firs
 
 // Documents is the resolver for the documents field.
 func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
@@ -255,11 +255,11 @@ func (r *controlResolver) Documents(ctx context.Context, obj *types.Control, fir
 
 // Audits is the resolver for the audits field.
 func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAuditList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.AuditOrderField]{
@@ -286,11 +286,11 @@ func (r *controlResolver) Audits(ctx context.Context, obj *types.Control, first
 
 // Obligations is the resolver for the obligations field.
 func (r *controlResolver) Obligations(ctx context.Context, obj *types.Control, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionObligationList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{
@@ -322,11 +322,11 @@ func (r *controlResolver) Permission(ctx context.Context, obj *types.Control, ac
 
 // TotalCount is the resolver for the totalCount field.
 func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.ControlConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionControlList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -387,11 +387,11 @@ func (r *controlConnectionResolver) TotalCount(ctx context.Context, obj *types.C
 
 // CreateControl is the resolver for the createControl field.
 func (r *mutationResolver) CreateControl(ctx context.Context, input types.CreateControlInput) (*types.CreateControlPayload, error) {
-	if err := r.authorize(ctx, input.FrameworkID, probo.ActionControlCreate); err != nil {
+	scope, err := r.authorize(ctx, input.FrameworkID, probo.ActionControlCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.FrameworkID)
 	prb := r.probo
 
 	control, err := prb.Controls.Create(
@@ -427,11 +427,11 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 
 // UpdateControl is the resolver for the updateControl field.
 func (r *mutationResolver) UpdateControl(ctx context.Context, input types.UpdateControlInput) (*types.UpdateControlPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionControlUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionControlUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	control, err := prb.Controls.Update(
@@ -467,15 +467,14 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 
 // DeleteControl is the resolver for the deleteControl field.
 func (r *mutationResolver) DeleteControl(ctx context.Context, input types.DeleteControlInput) (*types.DeleteControlPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ControlID)
 	prb := r.probo
 
-	err := prb.Controls.Delete(ctx, scope, input.ControlID)
-	if err != nil {
+	if err := prb.Controls.Delete(ctx, scope, input.ControlID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete control", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -487,11 +486,11 @@ func (r *mutationResolver) DeleteControl(ctx context.Context, input types.Delete
 
 // CreateControlMeasureMapping is the resolver for the createControlMeasureMapping field.
 func (r *mutationResolver) CreateControlMeasureMapping(ctx context.Context, input types.CreateControlMeasureMappingInput) (*types.CreateControlMeasureMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.MeasureID)
 	prb := r.probo
 
 	control, measure, err := prb.Controls.CreateMeasureMapping(ctx, scope, input.ControlID, input.MeasureID)
@@ -508,11 +507,11 @@ func (r *mutationResolver) CreateControlMeasureMapping(ctx context.Context, inpu
 
 // CreateControlDocumentMapping is the resolver for the createControlDocumentMapping field.
 func (r *mutationResolver) CreateControlDocumentMapping(ctx context.Context, input types.CreateControlDocumentMappingInput) (*types.CreateControlDocumentMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	control, document, err := prb.Controls.CreateDocumentMapping(ctx, scope, input.ControlID, input.DocumentID)
@@ -534,11 +533,11 @@ func (r *mutationResolver) CreateControlDocumentMapping(ctx context.Context, inp
 
 // DeleteControlMeasureMapping is the resolver for the deleteControlMeasureMapping field.
 func (r *mutationResolver) DeleteControlMeasureMapping(ctx context.Context, input types.DeleteControlMeasureMappingInput) (*types.DeleteControlMeasureMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlMeasureMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.MeasureID)
 	prb := r.probo
 
 	control, measure, err := prb.Controls.DeleteMeasureMapping(ctx, scope, input.ControlID, input.MeasureID)
@@ -555,11 +554,11 @@ func (r *mutationResolver) DeleteControlMeasureMapping(ctx context.Context, inpu
 
 // DeleteControlDocumentMapping is the resolver for the deleteControlDocumentMapping field.
 func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, input types.DeleteControlDocumentMappingInput) (*types.DeleteControlDocumentMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlDocumentMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	control, document, err := prb.Controls.DeleteDocumentMapping(ctx, scope, input.ControlID, input.DocumentID)
@@ -576,11 +575,11 @@ func (r *mutationResolver) DeleteControlDocumentMapping(ctx context.Context, inp
 
 // CreateApplicabilityStatement is the resolver for the createApplicabilityStatement field.
 func (r *mutationResolver) CreateApplicabilityStatement(ctx context.Context, input types.CreateApplicabilityStatementInput) (*types.CreateApplicabilityStatementPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionApplicabilityStatementCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionApplicabilityStatementCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID)
 	prb := r.probo
 
 	applicabilityStatement, err := prb.StatementsOfApplicability.CreateApplicabilityStatement(ctx, scope, input.StatementOfApplicabilityID, input.ControlID, input.Applicability, input.Justification)
@@ -596,11 +595,11 @@ func (r *mutationResolver) CreateApplicabilityStatement(ctx context.Context, inp
 
 // UpdateApplicabilityStatement is the resolver for the updateApplicabilityStatement field.
 func (r *mutationResolver) UpdateApplicabilityStatement(ctx context.Context, input types.UpdateApplicabilityStatementInput) (*types.UpdateApplicabilityStatementPayload, error) {
-	if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ApplicabilityStatementID)
 	prb := r.probo
 
 	applicabilityStatement, err := prb.StatementsOfApplicability.UpdateApplicabilityStatement(ctx, scope, input.ApplicabilityStatementID, input.Applicability, input.Justification)
@@ -616,15 +615,14 @@ func (r *mutationResolver) UpdateApplicabilityStatement(ctx context.Context, inp
 
 // DeleteApplicabilityStatement is the resolver for the deleteApplicabilityStatement field.
 func (r *mutationResolver) DeleteApplicabilityStatement(ctx context.Context, input types.DeleteApplicabilityStatementInput) (*types.DeleteApplicabilityStatementPayload, error) {
-	if err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ApplicabilityStatementID, probo.ActionApplicabilityStatementDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ApplicabilityStatementID)
 	prb := r.probo
 
-	err := prb.StatementsOfApplicability.DeleteApplicabilityStatement(ctx, scope, input.ApplicabilityStatementID)
-	if err != nil {
+	if err := prb.StatementsOfApplicability.DeleteApplicabilityStatement(ctx, scope, input.ApplicabilityStatementID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete applicability statement", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -636,11 +634,11 @@ func (r *mutationResolver) DeleteApplicabilityStatement(ctx context.Context, inp
 
 // CreateControlAuditMapping is the resolver for the createControlAuditMapping field.
 func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input types.CreateControlAuditMappingInput) (*types.CreateControlAuditMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AuditID)
 	prb := r.probo
 
 	control, audit, err := prb.Controls.CreateAuditMapping(ctx, scope, input.ControlID, input.AuditID)
@@ -657,11 +655,11 @@ func (r *mutationResolver) CreateControlAuditMapping(ctx context.Context, input
 
 // DeleteControlAuditMapping is the resolver for the deleteControlAuditMapping field.
 func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input types.DeleteControlAuditMappingInput) (*types.DeleteControlAuditMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlAuditMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.AuditID)
 	prb := r.probo
 
 	control, audit, err := prb.Controls.DeleteAuditMapping(ctx, scope, input.ControlID, input.AuditID)
@@ -678,11 +676,11 @@ func (r *mutationResolver) DeleteControlAuditMapping(ctx context.Context, input
 
 // CreateControlObligationMapping is the resolver for the createControlObligationMapping field.
 func (r *mutationResolver) CreateControlObligationMapping(ctx context.Context, input types.CreateControlObligationMappingInput) (*types.CreateControlObligationMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ObligationID)
 	prb := r.probo
 
 	control, obligation, err := prb.Controls.CreateObligationMapping(ctx, scope, input.ControlID, input.ObligationID)
@@ -699,11 +697,11 @@ func (r *mutationResolver) CreateControlObligationMapping(ctx context.Context, i
 
 // DeleteControlObligationMapping is the resolver for the deleteControlObligationMapping field.
 func (r *mutationResolver) DeleteControlObligationMapping(ctx context.Context, input types.DeleteControlObligationMappingInput) (*types.DeleteControlObligationMappingPayload, error) {
-	if err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ControlID, probo.ActionControlObligationMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ObligationID)
 	prb := r.probo
 
 	control, obligation, err := prb.Controls.DeleteObligationMapping(ctx, scope, input.ControlID, input.ObligationID)
@@ -720,11 +718,11 @@ func (r *mutationResolver) DeleteControlObligationMapping(ctx context.Context, i
 
 // CreateStatementOfApplicability is the resolver for the createStatementOfApplicability field.
 func (r *mutationResolver) CreateStatementOfApplicability(ctx context.Context, input types.CreateStatementOfApplicabilityInput) (*types.CreateStatementOfApplicabilityPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionStatementOfApplicabilityCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	statementOfApplicability, err := prb.StatementsOfApplicability.Create(
@@ -755,11 +753,11 @@ func (r *mutationResolver) CreateStatementOfApplicability(ctx context.Context, i
 
 // UpdateStatementOfApplicability is the resolver for the updateStatementOfApplicability field.
 func (r *mutationResolver) UpdateStatementOfApplicability(ctx context.Context, input types.UpdateStatementOfApplicabilityInput) (*types.UpdateStatementOfApplicabilityPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionStatementOfApplicabilityUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	var name *string
@@ -795,15 +793,14 @@ func (r *mutationResolver) UpdateStatementOfApplicability(ctx context.Context, i
 
 // DeleteStatementOfApplicability is the resolver for the deleteStatementOfApplicability field.
 func (r *mutationResolver) DeleteStatementOfApplicability(ctx context.Context, input types.DeleteStatementOfApplicabilityInput) (*types.DeleteStatementOfApplicabilityPayload, error) {
-	if err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityDelete); err != nil {
+	scope, err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID)
 	prb := r.probo
 
-	err := prb.StatementsOfApplicability.Delete(ctx, scope, input.StatementOfApplicabilityID)
-	if err != nil {
+	if err := prb.StatementsOfApplicability.Delete(ctx, scope, input.StatementOfApplicabilityID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete statement_of_applicability", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -815,11 +812,11 @@ func (r *mutationResolver) DeleteStatementOfApplicability(ctx context.Context, i
 
 // PublishStatementOfApplicability is the resolver for the publishStatementOfApplicability field.
 func (r *mutationResolver) PublishStatementOfApplicability(ctx context.Context, input types.PublishStatementOfApplicabilityInput) (*types.PublishStatementOfApplicabilityPayload, error) {
-	if err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityPublish); err != nil {
+	scope, err := r.authorize(ctx, input.StatementOfApplicabilityID, probo.ActionStatementOfApplicabilityPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.StatementOfApplicabilityID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishStatementOfApplicability(ctx, scope, input.StatementOfApplicabilityID, input.ApproverIds, input.Minor)
@@ -849,11 +846,11 @@ func (r *statementOfApplicabilityResolver) Document(ctx context.Context, obj *ty
 		return nil, nil
 	}
 
-	if err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.Document.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.Document.ID)
 	prb := r.probo
 
 	document, err := prb.Documents.Get(ctx, scope, obj.Document.ID)
@@ -872,7 +869,7 @@ func (r *statementOfApplicabilityResolver) Document(ctx context.Context, obj *ty
 
 // Organization is the resolver for the organization field.
 func (r *statementOfApplicabilityResolver) Organization(ctx context.Context, obj *types.StatementOfApplicability) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -894,11 +891,11 @@ func (r *statementOfApplicabilityResolver) Organization(ctx context.Context, obj
 
 // ApplicabilityStatements is the resolver for the applicabilityStatements field.
 func (r *statementOfApplicabilityResolver) ApplicabilityStatements(ctx context.Context, obj *types.StatementOfApplicability, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ApplicabilityStatementOrderBy) (*types.ApplicabilityStatementConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionApplicabilityStatementList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ApplicabilityStatementOrderField]{

pkg/server/api/console/v1/cookie_banner_resolvers.go

@@ -25,7 +25,7 @@ import (
 
 // Organization is the resolver for the organization field.
 func (r *cookieBannerResolver) Organization(ctx context.Context, obj *types.CookieBanner) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -47,7 +47,7 @@ func (r *cookieBannerResolver) Organization(ctx context.Context, obj *types.Cook
 
 // Categories is the resolver for the categories field.
 func (r *cookieBannerResolver) Categories(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.CookieCategoryOrderBy, filter *types.CookieCategoryFilter) (*types.CookieCategoryConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCookieCategoryList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionCookieCategoryList); err != nil {
 		return nil, err
 	}
 
@@ -85,12 +85,11 @@ func (r *cookieBannerResolver) Categories(ctx context.Context, obj *types.Cookie
 
 // Translations is the resolver for the translations field.
 func (r *cookieBannerResolver) Translations(ctx context.Context, obj *types.CookieBanner) ([]*types.CookieBannerTranslation, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	translations, err := r.cookieBanner.ListCookieBannerTranslations(ctx, scope, obj.ID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list cookie banner translations", log.Error(err))
@@ -107,12 +106,11 @@ func (r *cookieBannerResolver) Translations(ctx context.Context, obj *types.Cook
 
 // LatestVersion is the resolver for the latestVersion field.
 func (r *cookieBannerResolver) LatestVersion(ctx context.Context, obj *types.CookieBanner) (*types.CookieBannerVersion, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	cursor := &page.Cursor[coredata.CookieBannerVersionOrderField]{
 		Size:     1,
 		Position: page.Head,
@@ -145,7 +143,8 @@ func (r *cookieBannerResolver) LatestVersion(ctx context.Context, obj *types.Coo
 
 // ConsentRecords is the resolver for the consentRecords field.
 func (r *cookieBannerResolver) ConsentRecords(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.CookieConsentRecordOrderBy, filter *types.CookieConsentRecordFilter) (*types.CookieConsentRecordConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCookieConsentRecordList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieConsentRecordList)
+	if err != nil {
 		return nil, err
 	}
 
@@ -161,7 +160,6 @@ func (r *cookieBannerResolver) ConsentRecords(ctx context.Context, obj *types.Co
 	}
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 
 	var (
 		action    *coredata.CookieConsentAction
@@ -189,7 +187,7 @@ func (r *cookieBannerResolver) ConsentRecords(ctx context.Context, obj *types.Co
 
 // TrackerPatterns is the resolver for the trackerPatterns field.
 func (r *cookieBannerResolver) TrackerPatterns(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerPatternOrderBy, filter *types.TrackerPatternFilter) (*types.TrackerPatternConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil {
 		return nil, err
 	}
 
@@ -226,7 +224,7 @@ func (r *cookieBannerResolver) TrackerPatterns(ctx context.Context, obj *types.C
 
 // UncategorisedTrackerResources is the resolver for the uncategorisedTrackerResources field.
 func (r *cookieBannerResolver) UncategorisedTrackerResources(ctx context.Context, obj *types.CookieBanner, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerResourceOrderBy, filter *types.TrackerResourceFilter) (*types.TrackerResourceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil {
 		return nil, err
 	}
 
@@ -267,12 +265,11 @@ func (r *cookieBannerResolver) Permission(ctx context.Context, obj *types.Cookie
 
 // TotalCount is the resolver for the totalCount field.
 func (r *cookieBannerConnectionResolver) TotalCount(ctx context.Context, obj *types.CookieBannerConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionCookieBannerList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionCookieBannerList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.cookieBanner.CountCookieBannersForOrganization(ctx, scope, obj.ParentID, coredata.NewCookieBannerFilter(nil))
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count cookie banners", log.Error(err))
@@ -284,12 +281,11 @@ func (r *cookieBannerConnectionResolver) TotalCount(ctx context.Context, obj *ty
 
 // Categories is the resolver for the categories field.
 func (r *cookieBannerVersionResolver) Categories(ctx context.Context, obj *types.CookieBannerVersion) ([]*types.CookieBannerVersionCategory, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerVersionGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	version, err := r.cookieBanner.GetCookieBannerVersion(ctx, scope, obj.ID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot get cookie banner version", log.Error(err))
@@ -331,7 +327,7 @@ func (r *cookieCategoryResolver) CookieBanner(ctx context.Context, obj *types.Co
 		return nil, nil
 	}
 
-	if err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil {
+	if _, err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil {
 		return nil, err
 	}
 
@@ -353,7 +349,7 @@ func (r *cookieCategoryResolver) CookieBanner(ctx context.Context, obj *types.Co
 
 // TrackerPatterns is the resolver for the trackerPatterns field.
 func (r *cookieCategoryResolver) TrackerPatterns(ctx context.Context, obj *types.CookieCategory, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerPatternOrderBy) (*types.TrackerPatternConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerPatternList); err != nil {
 		return nil, err
 	}
 
@@ -384,7 +380,7 @@ func (r *cookieCategoryResolver) TrackerPatterns(ctx context.Context, obj *types
 
 // TrackerResources is the resolver for the trackerResources field.
 func (r *cookieCategoryResolver) TrackerResources(ctx context.Context, obj *types.CookieCategory, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TrackerResourceOrderBy) (*types.TrackerResourceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionTrackerResourceList); err != nil {
 		return nil, err
 	}
 
@@ -420,12 +416,11 @@ func (r *cookieCategoryResolver) Permission(ctx context.Context, obj *types.Cook
 
 // TotalCount is the resolver for the totalCount field.
 func (r *cookieCategoryConnectionResolver) TotalCount(ctx context.Context, obj *types.CookieCategoryConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionCookieCategoryList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionCookieCategoryList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.cookieBanner.CountCategoriesForBanner(ctx, scope, obj.ParentID, obj.Filter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count cookie categories", log.Error(err))
@@ -450,12 +445,11 @@ func (r *detectedTrackerConnectionResolver) TotalCount(ctx context.Context, obj
 
 // CreateCookieBanner is the resolver for the createCookieBanner field.
 func (r *mutationResolver) CreateCookieBanner(ctx context.Context, input types.CreateCookieBannerInput) (*types.CreateCookieBannerPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionCookieBannerCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
-
 	banner, err := r.cookieBanner.CreateCookieBanner(
 		ctx,
 		scope,
@@ -489,12 +483,11 @@ func (r *mutationResolver) CreateCookieBanner(ctx context.Context, input types.C
 
 // UpdateCookieBanner is the resolver for the updateCookieBanner field.
 func (r *mutationResolver) UpdateCookieBanner(ctx context.Context, input types.UpdateCookieBannerInput) (*types.UpdateCookieBannerPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
 	banner, err := r.cookieBanner.UpdateCookieBanner(
 		ctx,
 		scope,
@@ -528,14 +521,12 @@ func (r *mutationResolver) UpdateCookieBanner(ctx context.Context, input types.U
 
 // DeleteCookieBanner is the resolver for the deleteCookieBanner field.
 func (r *mutationResolver) DeleteCookieBanner(ctx context.Context, input types.DeleteCookieBannerInput) (*types.DeleteCookieBannerPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDelete); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
-	err := r.cookieBanner.DeleteCookieBanner(ctx, scope, input.CookieBannerID)
-	if err != nil {
+	if err := r.cookieBanner.DeleteCookieBanner(ctx, scope, input.CookieBannerID); err != nil {
 		if errors.Is(err, cookiebanner.ErrBannerNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
 		}
@@ -552,12 +543,11 @@ func (r *mutationResolver) DeleteCookieBanner(ctx context.Context, input types.D
 
 // ActivateCookieBanner is the resolver for the activateCookieBanner field.
 func (r *mutationResolver) ActivateCookieBanner(ctx context.Context, input types.ActivateCookieBannerInput) (*types.ActivateCookieBannerPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerActivate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerActivate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
 	banner, err := r.cookieBanner.ActivateCookieBanner(ctx, scope, input.CookieBannerID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrBannerNotFound) {
@@ -584,12 +574,11 @@ func (r *mutationResolver) ActivateCookieBanner(ctx context.Context, input types
 
 // DeactivateCookieBanner is the resolver for the deactivateCookieBanner field.
 func (r *mutationResolver) DeactivateCookieBanner(ctx context.Context, input types.DeactivateCookieBannerInput) (*types.DeactivateCookieBannerPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDeactivate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerDeactivate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
 	banner, err := r.cookieBanner.DeactivateCookieBanner(ctx, scope, input.CookieBannerID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrBannerNotFound) {
@@ -612,12 +601,11 @@ func (r *mutationResolver) DeactivateCookieBanner(ctx context.Context, input typ
 
 // PublishCookieBannerVersion is the resolver for the publishCookieBannerVersion field.
 func (r *mutationResolver) PublishCookieBannerVersion(ctx context.Context, input types.PublishCookieBannerVersionInput) (*types.PublishCookieBannerVersionPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerVersionPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
 	version, err := r.cookieBanner.PublishCookieBannerVersion(ctx, scope, input.CookieBannerID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrNoDraftVersion) {
@@ -649,12 +637,11 @@ func (r *mutationResolver) PublishCookieBannerVersion(ctx context.Context, input
 
 // CreateCookieCategory is the resolver for the createCookieCategory field.
 func (r *mutationResolver) CreateCookieCategory(ctx context.Context, input types.CreateCookieCategoryInput) (*types.CreateCookieCategoryPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieCategoryCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
 	category, err := r.cookieBanner.CreateCookieCategory(
 		ctx,
 		scope,
@@ -698,12 +685,11 @@ func (r *mutationResolver) CreateCookieCategory(ctx context.Context, input types
 
 // UpdateCookieCategory is the resolver for the updateCookieCategory field.
 func (r *mutationResolver) UpdateCookieCategory(ctx context.Context, input types.UpdateCookieCategoryInput) (*types.UpdateCookieCategoryPayload, error) {
-	if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
-
 	var gcmConsentTypes *[]string
 	if input.GcmConsentTypes != nil {
 		gcmConsentTypes = &input.GcmConsentTypes
@@ -759,12 +745,11 @@ func (r *mutationResolver) UpdateCookieCategory(ctx context.Context, input types
 
 // DeleteCookieCategory is the resolver for the deleteCookieCategory field.
 func (r *mutationResolver) DeleteCookieCategory(ctx context.Context, input types.DeleteCookieCategoryInput) (*types.DeleteCookieCategoryPayload, error) {
-	if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryDelete); err != nil {
+	scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
-
 	category, err := r.cookieBanner.GetCookieCategory(ctx, scope, input.CookieCategoryID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrCategoryNotFound) {
@@ -809,12 +794,11 @@ func (r *mutationResolver) DeleteCookieCategory(ctx context.Context, input types
 
 // ReorderCookieCategory is the resolver for the reorderCookieCategory field.
 func (r *mutationResolver) ReorderCookieCategory(ctx context.Context, input types.ReorderCookieCategoryInput) (*types.ReorderCookieCategoryPayload, error) {
-	if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionCookieCategoryUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
-
 	banner, err := r.cookieBanner.ReorderCookieCategory(
 		ctx,
 		scope,
@@ -844,12 +828,11 @@ func (r *mutationResolver) ReorderCookieCategory(ctx context.Context, input type
 
 // UpsertCookieBannerTranslation is the resolver for the upsertCookieBannerTranslation field.
 func (r *mutationResolver) UpsertCookieBannerTranslation(ctx context.Context, input types.UpsertCookieBannerTranslationInput) (*types.UpsertCookieBannerTranslationPayload, error) {
-	if err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieBannerID, probo.ActionCookieBannerUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieBannerID)
-
 	translation, err := r.cookieBanner.UpsertCookieBannerTranslation(
 		ctx,
 		scope,
@@ -887,12 +870,11 @@ func (r *mutationResolver) UpsertCookieBannerTranslation(ctx context.Context, in
 
 // CreateTrackerPattern is the resolver for the createTrackerPattern field.
 func (r *mutationResolver) CreateTrackerPattern(ctx context.Context, input types.CreateTrackerPatternInput) (*types.CreateTrackerPatternPayload, error) {
-	if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternCreate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerPatternCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
-
 	trackerType := coredata.TrackerTypeCookie
 	if input.TrackerType != nil {
 		trackerType = *input.TrackerType
@@ -946,12 +928,11 @@ func (r *mutationResolver) CreateTrackerPattern(ctx context.Context, input types
 
 // UpdateTrackerPattern is the resolver for the updateTrackerPattern field.
 func (r *mutationResolver) UpdateTrackerPattern(ctx context.Context, input types.UpdateTrackerPatternInput) (*types.UpdateTrackerPatternPayload, error) {
-	if err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrackerPatternID)
-
 	pattern, err := r.cookieBanner.UpdateTrackerPattern(
 		ctx,
 		scope,
@@ -988,12 +969,11 @@ func (r *mutationResolver) UpdateTrackerPattern(ctx context.Context, input types
 
 // DeleteTrackerPattern is the resolver for the deleteTrackerPattern field.
 func (r *mutationResolver) DeleteTrackerPattern(ctx context.Context, input types.DeleteTrackerPatternInput) (*types.DeleteTrackerPatternPayload, error) {
-	if err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternDelete); err != nil {
+	scope, err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrackerPatternID)
-
 	pattern, err := r.cookieBanner.GetTrackerPattern(ctx, scope, input.TrackerPatternID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrTrackerPatternNotFound) {
@@ -1033,16 +1013,15 @@ func (r *mutationResolver) DeleteTrackerPattern(ctx context.Context, input types
 
 // MoveTrackerPatternToCategory is the resolver for the moveTrackerPatternToCategory field.
 func (r *mutationResolver) MoveTrackerPatternToCategory(ctx context.Context, input types.MoveTrackerPatternToCategoryInput) (*types.MoveTrackerPatternToCategoryPayload, error) {
-	if err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TrackerPatternID, probo.ActionTrackerPatternUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	if err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrackerPatternID)
-
 	result, err := r.cookieBanner.MoveTrackerPatternToCategory(
 		ctx,
 		scope,
@@ -1073,12 +1052,11 @@ func (r *mutationResolver) MoveTrackerPatternToCategory(ctx context.Context, inp
 
 // CreateTrackerResource is the resolver for the createTrackerResource field.
 func (r *mutationResolver) CreateTrackerResource(ctx context.Context, input types.CreateTrackerResourceInput) (*types.CreateTrackerResourcePayload, error) {
-	if err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceCreate); err != nil {
+	scope, err := r.authorize(ctx, input.CookieCategoryID, probo.ActionTrackerResourceCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.CookieCategoryID)
-
 	var description string
 	if input.Description != nil {
 		description = *input.Description
@@ -1126,12 +1104,11 @@ func (r *mutationResolver) CreateTrackerResource(ctx context.Context, input type
 
 // UpdateTrackerResource is the resolver for the updateTrackerResource field.
 func (r *mutationResolver) UpdateTrackerResource(ctx context.Context, input types.UpdateTrackerResourceInput) (*types.UpdateTrackerResourcePayload, error) {
-	if err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrackerResourceID)
-
 	resource, err := r.cookieBanner.UpdateTrackerResource(
 		ctx,
 		scope,
@@ -1172,12 +1149,11 @@ func (r *mutationResolver) UpdateTrackerResource(ctx context.Context, input type
 
 // DeleteTrackerResource is the resolver for the deleteTrackerResource field.
 func (r *mutationResolver) DeleteTrackerResource(ctx context.Context, input types.DeleteTrackerResourceInput) (*types.DeleteTrackerResourcePayload, error) {
-	if err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceDelete); err != nil {
+	scope, err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrackerResourceID)
-
 	resource, err := r.cookieBanner.GetTrackerResource(ctx, scope, input.TrackerResourceID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrTrackerResourceNotFound) {
@@ -1217,16 +1193,15 @@ func (r *mutationResolver) DeleteTrackerResource(ctx context.Context, input type
 
 // MoveTrackerResourceToCategory is the resolver for the moveTrackerResourceToCategory field.
 func (r *mutationResolver) MoveTrackerResourceToCategory(ctx context.Context, input types.MoveTrackerResourceToCategoryInput) (*types.MoveTrackerResourceToCategoryPayload, error) {
-	if err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TrackerResourceID, probo.ActionTrackerResourceUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	if err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.TargetCookieCategoryID, probo.ActionCookieCategoryUpdate); err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrackerResourceID)
-
 	result, err := r.cookieBanner.MoveTrackerResourceToCategory(
 		ctx,
 		scope,
@@ -1259,7 +1234,7 @@ func (r *mutationResolver) MoveTrackerResourceToCategory(ctx context.Context, in
 
 // CookieCategory is the resolver for the cookieCategory field.
 func (r *trackerPatternResolver) CookieCategory(ctx context.Context, obj *types.TrackerPattern) (*types.CookieCategory, error) {
-	if err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil {
+	if _, err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil {
 		return nil, err
 	}
 
@@ -1360,7 +1335,7 @@ func (r *trackerPatternConnectionResolver) TotalCount(ctx context.Context, obj *
 
 // CookieCategory is the resolver for the cookieCategory field.
 func (r *trackerResourceResolver) CookieCategory(ctx context.Context, obj *types.TrackerResource) (*types.CookieCategory, error) {
-	if err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil {
+	if _, err := r.authorize(ctx, obj.CookieCategory.ID, probo.ActionCookieCategoryGet); err != nil {
 		return nil, err
 	}
 

pkg/server/api/console/v1/cookie_consent_record_resolvers.go

@@ -22,7 +22,7 @@ import (
 
 // CookieBanner is the resolver for the cookieBanner field.
 func (r *cookieConsentRecordResolver) CookieBanner(ctx context.Context, obj *types.CookieConsentRecord) (*types.CookieBanner, error) {
-	if err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil {
+	if _, err := r.authorize(ctx, obj.CookieBanner.ID, probo.ActionCookieBannerGet); err != nil {
 		return nil, err
 	}
 
@@ -44,12 +44,11 @@ func (r *cookieConsentRecordResolver) CookieBanner(ctx context.Context, obj *typ
 
 // CookieBannerVersion is the resolver for the cookieBannerVersion field.
 func (r *cookieConsentRecordResolver) CookieBannerVersion(ctx context.Context, obj *types.CookieConsentRecord) (*types.CookieBannerVersion, error) {
-	if err := r.authorize(ctx, obj.CookieBannerVersion.ID, probo.ActionCookieBannerVersionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.CookieBannerVersion.ID, probo.ActionCookieBannerVersionGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.CookieBannerVersion.ID)
-
 	version, err := r.cookieBanner.GetCookieBannerVersion(ctx, scope, obj.CookieBannerVersion.ID)
 	if err != nil {
 		if errors.Is(err, cookiebanner.ErrVersionNotFound) {
@@ -72,12 +71,11 @@ func (r *cookieConsentRecordResolver) CookieBannerVersion(ctx context.Context, o
 
 // TotalCount is the resolver for the totalCount field.
 func (r *cookieConsentRecordConnectionResolver) TotalCount(ctx context.Context, obj *types.CookieConsentRecordConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionCookieConsentRecordList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionCookieConsentRecordList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.cookieBanner.CountCookieConsentRecordsForBanner(ctx, scope, obj.ParentID, obj.Filter)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count consent records", log.Error(err))

pkg/server/api/console/v1/data_protection_impact_assessment_resolvers.go

@@ -22,11 +22,11 @@ import (
 
 // ProcessingActivity is the resolver for the processingActivity field.
 func (r *dataProtectionImpactAssessmentResolver) ProcessingActivity(ctx context.Context, obj *types.DataProtectionImpactAssessment) (*types.ProcessingActivity, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, scope, obj.ID)
@@ -46,11 +46,11 @@ func (r *dataProtectionImpactAssessmentResolver) ProcessingActivity(ctx context.
 
 // Organization is the resolver for the organization field.
 func (r *dataProtectionImpactAssessmentResolver) Organization(ctx context.Context, obj *types.DataProtectionImpactAssessment) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	dpia, err := prb.DataProtectionImpactAssessments.Get(ctx, scope, obj.ID)
@@ -80,11 +80,11 @@ func (r *dataProtectionImpactAssessmentResolver) Permission(ctx context.Context,
 
 // TotalCount is the resolver for the totalCount field.
 func (r *dataProtectionImpactAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.DataProtectionImpactAssessmentConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDataProtectionImpactAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDataProtectionImpactAssessmentList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -105,11 +105,11 @@ func (r *dataProtectionImpactAssessmentConnectionResolver) TotalCount(ctx contex
 
 // CreateDataProtectionImpactAssessment is the resolver for the createDataProtectionImpactAssessment field.
 func (r *mutationResolver) CreateDataProtectionImpactAssessment(ctx context.Context, input types.CreateDataProtectionImpactAssessmentInput) (*types.CreateDataProtectionImpactAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionDataProtectionImpactAssessmentCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionDataProtectionImpactAssessmentCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID)
 	prb := r.probo
 
 	req := probo.CreateDataProtectionImpactAssessmentRequest{
@@ -143,11 +143,11 @@ func (r *mutationResolver) CreateDataProtectionImpactAssessment(ctx context.Cont
 
 // UpdateDataProtectionImpactAssessment is the resolver for the updateDataProtectionImpactAssessment field.
 func (r *mutationResolver) UpdateDataProtectionImpactAssessment(ctx context.Context, input types.UpdateDataProtectionImpactAssessmentInput) (*types.UpdateDataProtectionImpactAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionDataProtectionImpactAssessmentUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateDataProtectionImpactAssessmentRequest{
@@ -177,15 +177,14 @@ func (r *mutationResolver) UpdateDataProtectionImpactAssessment(ctx context.Cont
 
 // DeleteDataProtectionImpactAssessment is the resolver for the deleteDataProtectionImpactAssessment field.
 func (r *mutationResolver) DeleteDataProtectionImpactAssessment(ctx context.Context, input types.DeleteDataProtectionImpactAssessmentInput) (*types.DeleteDataProtectionImpactAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.DataProtectionImpactAssessmentID, probo.ActionDataProtectionImpactAssessmentDelete); err != nil {
+	scope, err := r.authorize(ctx, input.DataProtectionImpactAssessmentID, probo.ActionDataProtectionImpactAssessmentDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DataProtectionImpactAssessmentID)
 	prb := r.probo
 
-	err := prb.DataProtectionImpactAssessments.Delete(ctx, scope, input.DataProtectionImpactAssessmentID)
-	if err != nil {
+	if err := prb.DataProtectionImpactAssessments.Delete(ctx, scope, input.DataProtectionImpactAssessmentID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete data protection impact assessment", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -197,11 +196,11 @@ func (r *mutationResolver) DeleteDataProtectionImpactAssessment(ctx context.Cont
 
 // CreateTransferImpactAssessment is the resolver for the createTransferImpactAssessment field.
 func (r *mutationResolver) CreateTransferImpactAssessment(ctx context.Context, input types.CreateTransferImpactAssessmentInput) (*types.CreateTransferImpactAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionTransferImpactAssessmentCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionTransferImpactAssessmentCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID)
 	prb := r.probo
 
 	req := probo.CreateTransferImpactAssessmentRequest{
@@ -235,11 +234,11 @@ func (r *mutationResolver) CreateTransferImpactAssessment(ctx context.Context, i
 
 // UpdateTransferImpactAssessment is the resolver for the updateTransferImpactAssessment field.
 func (r *mutationResolver) UpdateTransferImpactAssessment(ctx context.Context, input types.UpdateTransferImpactAssessmentInput) (*types.UpdateTransferImpactAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTransferImpactAssessmentUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateTransferImpactAssessmentRequest{
@@ -269,15 +268,14 @@ func (r *mutationResolver) UpdateTransferImpactAssessment(ctx context.Context, i
 
 // DeleteTransferImpactAssessment is the resolver for the deleteTransferImpactAssessment field.
 func (r *mutationResolver) DeleteTransferImpactAssessment(ctx context.Context, input types.DeleteTransferImpactAssessmentInput) (*types.DeleteTransferImpactAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.TransferImpactAssessmentID, probo.ActionTransferImpactAssessmentDelete); err != nil {
+	scope, err := r.authorize(ctx, input.TransferImpactAssessmentID, probo.ActionTransferImpactAssessmentDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TransferImpactAssessmentID)
 	prb := r.probo
 
-	err := prb.TransferImpactAssessments.Delete(ctx, scope, input.TransferImpactAssessmentID)
-	if err != nil {
+	if err := prb.TransferImpactAssessments.Delete(ctx, scope, input.TransferImpactAssessmentID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete transfer impact assessment", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -289,11 +287,11 @@ func (r *mutationResolver) DeleteTransferImpactAssessment(ctx context.Context, i
 
 // PublishDataProtectionImpactAssessmentList is the resolver for the publishDataProtectionImpactAssessmentList field.
 func (r *mutationResolver) PublishDataProtectionImpactAssessmentList(ctx context.Context, input types.PublishDataProtectionImpactAssessmentListInput) (*types.PublishDataProtectionImpactAssessmentListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDataProtectionImpactAssessmentPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishDataProtectionImpactAssessmentList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -319,11 +317,11 @@ func (r *mutationResolver) PublishDataProtectionImpactAssessmentList(ctx context
 
 // PublishTransferImpactAssessmentList is the resolver for the publishTransferImpactAssessmentList field.
 func (r *mutationResolver) PublishTransferImpactAssessmentList(ctx context.Context, input types.PublishTransferImpactAssessmentListInput) (*types.PublishTransferImpactAssessmentListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionTransferImpactAssessmentPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishTransferImpactAssessmentList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -349,11 +347,11 @@ func (r *mutationResolver) PublishTransferImpactAssessmentList(ctx context.Conte
 
 // ProcessingActivity is the resolver for the processingActivity field.
 func (r *transferImpactAssessmentResolver) ProcessingActivity(ctx context.Context, obj *types.TransferImpactAssessment) (*types.ProcessingActivity, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	processingActivity, err := prb.ProcessingActivities.Get(ctx, scope, obj.ProcessingActivity.ID)
@@ -367,7 +365,7 @@ func (r *transferImpactAssessmentResolver) ProcessingActivity(ctx context.Contex
 
 // Organization is the resolver for the organization field.
 func (r *transferImpactAssessmentResolver) Organization(ctx context.Context, obj *types.TransferImpactAssessment) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -394,11 +392,11 @@ func (r *transferImpactAssessmentResolver) Permission(ctx context.Context, obj *
 
 // TotalCount is the resolver for the totalCount field.
 func (r *transferImpactAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.TransferImpactAssessmentConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionTransferImpactAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTransferImpactAssessmentList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/console/v1/document_resolvers.go

@@ -29,7 +29,7 @@ import (
 
 // Organization is the resolver for the organization field.
 func (r *documentResolver) Organization(ctx context.Context, obj *types.Document) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -51,11 +51,11 @@ func (r *documentResolver) Organization(ctx context.Context, obj *types.Document
 
 // Versions is the resolver for the versions field.
 func (r *documentResolver) Versions(ctx context.Context, obj *types.Document, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionOrderBy, filter *types.DocumentVersionFilter) (*types.DocumentVersionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
@@ -87,11 +87,11 @@ func (r *documentResolver) Versions(ctx context.Context, obj *types.Document, fi
 
 // Controls is the resolver for the controls field.
 func (r *documentResolver) Controls(ctx context.Context, obj *types.Document, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
@@ -123,11 +123,11 @@ func (r *documentResolver) Controls(ctx context.Context, obj *types.Document, fi
 
 // DefaultApprovers is the resolver for the defaultApprovers field.
 func (r *documentResolver) DefaultApprovers(ctx context.Context, obj *types.Document) ([]*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	profiles, err := prb.Documents.GetDefaultApprovers(ctx, scope, obj.ID)
@@ -151,11 +151,11 @@ func (r *documentResolver) Permission(ctx context.Context, obj *types.Document,
 
 // TotalCount is the resolver for the totalCount field.
 func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -200,7 +200,7 @@ func (r *documentConnectionResolver) TotalCount(ctx context.Context, obj *types.
 
 // Document is the resolver for the document field.
 func (r *documentVersionResolver) Document(ctx context.Context, obj *types.DocumentVersion) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
 		return nil, err
 	}
 
@@ -222,7 +222,8 @@ func (r *documentVersionResolver) Document(ctx context.Context, obj *types.Docum
 
 // Approvers is the resolver for the approvers field.
 func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList)
+	if err != nil {
 		return nil, err
 	}
 
@@ -233,7 +234,6 @@ func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.Docu
 		}, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.MembershipProfileOrderField]{
@@ -258,11 +258,11 @@ func (r *documentVersionResolver) Approvers(ctx context.Context, obj *types.Docu
 
 // Signatures is the resolver for the signatures field.
 func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionSignatureOrder, filter *types.DocumentVersionSignatureFilter) (*types.DocumentVersionSignatureConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionSignatureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionSignatureList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionSignatureOrderField]{
@@ -311,11 +311,11 @@ func (r *documentVersionResolver) Signatures(ctx context.Context, obj *types.Doc
 
 // ApprovalQuorums is the resolver for the approvalQuorums field.
 func (r *documentVersionResolver) ApprovalQuorums(ctx context.Context, obj *types.DocumentVersion, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionApprovalQuorumOrder) (*types.DocumentVersionApprovalQuorumConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalQuorumOrderField]{
@@ -342,13 +342,12 @@ func (r *documentVersionResolver) ApprovalQuorums(ctx context.Context, obj *type
 
 // Signed is the resolver for the signed field.
 func (r *documentVersionResolver) Signed(ctx context.Context, obj *types.DocumentVersion) (bool, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet)
+	if err != nil {
 		return false, err
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, scope, obj.ID, identity.EmailAddress)
@@ -367,11 +366,11 @@ func (r *documentVersionResolver) Permission(ctx context.Context, obj *types.Doc
 
 // Quorum is the resolver for the quorum field.
 func (r *documentVersionApprovalDecisionResolver) Quorum(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.DocumentVersionApprovalQuorum, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	quorum, err := prb.DocumentApprovals.GetQuorum(ctx, scope, obj.Quorum.ID)
@@ -390,11 +389,11 @@ func (r *documentVersionApprovalDecisionResolver) Quorum(ctx context.Context, ob
 
 // DocumentVersion is the resolver for the documentVersion field.
 func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.DocumentVersion, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	quorum, err := prb.DocumentApprovals.GetQuorum(ctx, scope, obj.Quorum.ID)
@@ -424,7 +423,7 @@ func (r *documentVersionApprovalDecisionResolver) DocumentVersion(ctx context.Co
 
 // Approver is the resolver for the approver field.
 func (r *documentVersionApprovalDecisionResolver) Approver(ctx context.Context, obj *types.DocumentVersionApprovalDecision) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -471,11 +470,11 @@ func (r *documentVersionApprovalDecisionConnectionResolver) TotalCount(ctx conte
 		return 0, nil
 	}
 
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	filter := coredata.NewDocumentVersionApprovalDecisionFilter(nil)
@@ -494,11 +493,11 @@ func (r *documentVersionApprovalDecisionConnectionResolver) TotalCount(ctx conte
 
 // DocumentVersion is the resolver for the documentVersion field.
 func (r *documentVersionApprovalQuorumResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionApprovalQuorum) (*types.DocumentVersion, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentVersion, err := prb.Documents.GetVersion(ctx, scope, obj.DocumentVersion.ID)
@@ -517,11 +516,11 @@ func (r *documentVersionApprovalQuorumResolver) DocumentVersion(ctx context.Cont
 
 // Decisions is the resolver for the decisions field.
 func (r *documentVersionApprovalQuorumResolver) Decisions(ctx context.Context, obj *types.DocumentVersionApprovalQuorum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionApprovalDecisionOrder, filter *types.DocumentVersionApprovalDecisionFilter) (*types.DocumentVersionApprovalDecisionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionApprovalList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionApprovalDecisionOrderField]{
@@ -560,11 +559,11 @@ func (r *documentVersionApprovalQuorumResolver) Permission(ctx context.Context,
 
 // TotalCount is the resolver for the totalCount field.
 func (r *documentVersionApprovalQuorumConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentVersionApprovalQuorumConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionApprovalList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	count, err := prb.DocumentApprovals.CountQuorums(ctx, scope, obj.ParentID)
@@ -578,11 +577,11 @@ func (r *documentVersionApprovalQuorumConnectionResolver) TotalCount(ctx context
 
 // TotalCount is the resolver for the totalCount field.
 func (r *documentVersionConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentVersionConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -608,11 +607,11 @@ func (r *documentVersionConnectionResolver) TotalCount(ctx context.Context, obj
 
 // DocumentVersion is the resolver for the documentVersion field.
 func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context, obj *types.DocumentVersionSignature) (*types.DocumentVersion, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentVersionGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentVersion, err := prb.Documents.GetVersion(ctx, scope, obj.DocumentVersion.ID)
@@ -631,7 +630,7 @@ func (r *documentVersionSignatureResolver) DocumentVersion(ctx context.Context,
 
 // SignedBy is the resolver for the signedBy field.
 func (r *documentVersionSignatureResolver) SignedBy(ctx context.Context, obj *types.DocumentVersionSignature) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -658,11 +657,11 @@ func (r *documentVersionSignatureResolver) Permission(ctx context.Context, obj *
 
 // TotalCount is the resolver for the totalCount field.
 func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Context, obj *types.DocumentVersionSignatureConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionSignatureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionDocumentVersionSignatureList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -688,13 +687,12 @@ func (r *documentVersionSignatureConnectionResolver) TotalCount(ctx context.Cont
 
 // Signed is the resolver for the signed field.
 func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.EmployeeDocument) (*bool, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	signed, err := prb.Documents.IsSigned(ctx, scope, obj.ID, identity.EmailAddress)
@@ -713,7 +711,7 @@ func (r *employeeDocumentResolver) Signed(ctx context.Context, obj *types.Employ
 
 // ApprovalState is the resolver for the approvalState field.
 func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types.EmployeeDocument) (*coredata.DocumentVersionApprovalDecisionState, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
 		return nil, err
 	}
 
@@ -738,11 +736,11 @@ func (r *employeeDocumentResolver) ApprovalState(ctx context.Context, obj *types
 
 // Versions is the resolver for the versions field.
 func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.EmployeeDocument, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentVersionOrderBy) (*types.EmployeeDocumentVersionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionEmployeeDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
@@ -805,13 +803,12 @@ func (r *employeeDocumentResolver) Versions(ctx context.Context, obj *types.Empl
 
 // Signed is the resolver for the signed field.
 func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types.EmployeeDocumentVersion) (bool, error) {
-	if err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet)
+	if err != nil {
 		return false, err
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	signed, err := prb.Documents.IsVersionSignedByUserEmail(ctx, scope, obj.ID, identity.EmailAddress)
@@ -825,7 +822,7 @@ func (r *employeeDocumentVersionResolver) Signed(ctx context.Context, obj *types
 
 // ApprovalDecision is the resolver for the approvalDecision field.
 func (r *employeeDocumentVersionResolver) ApprovalDecision(ctx context.Context, obj *types.EmployeeDocumentVersion) (*types.DocumentVersionApprovalDecision, error) {
-	if err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil {
+	if _, err := r.authorize(ctx, obj.DocumentID, probo.ActionEmployeeDocumentGet); err != nil {
 		return nil, err
 	}
 
@@ -849,11 +846,11 @@ func (r *employeeDocumentVersionResolver) ApprovalDecision(ctx context.Context,
 
 // CreateDocument is the resolver for the createDocument field.
 func (r *mutationResolver) CreateDocument(ctx context.Context, input types.CreateDocumentInput) (*types.CreateDocumentPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	var content string
@@ -895,11 +892,11 @@ func (r *mutationResolver) CreateDocument(ctx context.Context, input types.Creat
 
 // UpdateDocument is the resolver for the updateDocument field.
 func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.UpdateDocumentInput) (*types.UpdateDocumentPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionDocumentUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionDocumentUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	var defaultApproverIDs *[]gid.GID
@@ -961,11 +958,11 @@ func (r *mutationResolver) UpdateDocument(ctx context.Context, input types.Updat
 
 // DeleteDocumentDraft is the resolver for the deleteDocumentDraft field.
 func (r *mutationResolver) DeleteDocumentDraft(ctx context.Context, input types.DeleteDocumentDraftInput) (*types.DeleteDocumentDraftPayload, error) {
-	if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDeleteDraft); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDeleteDraft)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	document, err := prb.Documents.DeleteDraft(ctx, scope, input.DocumentID)
@@ -994,11 +991,11 @@ func (r *mutationResolver) DeleteDocumentDraft(ctx context.Context, input types.
 
 // ArchiveDocument is the resolver for the archiveDocument field.
 func (r *mutationResolver) ArchiveDocument(ctx context.Context, input types.ArchiveDocumentInput) (*types.ArchiveDocumentPayload, error) {
-	if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentArchive); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentArchive)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	document, err := prb.Documents.Archive(ctx, scope, input.DocumentID)
@@ -1019,11 +1016,11 @@ func (r *mutationResolver) ArchiveDocument(ctx context.Context, input types.Arch
 
 // UnarchiveDocument is the resolver for the unarchiveDocument field.
 func (r *mutationResolver) UnarchiveDocument(ctx context.Context, input types.UnarchiveDocumentInput) (*types.UnarchiveDocumentPayload, error) {
-	if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentUnarchive); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentUnarchive)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	document, err := prb.Documents.Unarchive(ctx, scope, input.DocumentID)
@@ -1044,15 +1041,14 @@ func (r *mutationResolver) UnarchiveDocument(ctx context.Context, input types.Un
 
 // DeleteDocument is the resolver for the deleteDocument field.
 func (r *mutationResolver) DeleteDocument(ctx context.Context, input types.DeleteDocumentInput) (*types.DeleteDocumentPayload, error) {
-	if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDelete); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
-	err := prb.Documents.SoftDelete(ctx, scope, input.DocumentID)
-	if err != nil {
+	if err := prb.Documents.SoftDelete(ctx, scope, input.DocumentID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot soft delete document", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -1069,11 +1065,11 @@ func (r *mutationResolver) PublishDocument(ctx context.Context, input types.Publ
 		action = probo.ActionDocumentVersionRequestApproval
 	}
 
-	if err := r.authorize(ctx, input.DocumentID, action); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentID, action)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	result, err := prb.Documents.PublishVersion(ctx, scope, probo.PublishDocumentRequest{
@@ -1133,7 +1129,7 @@ func (r *mutationResolver) BulkPublishDocuments(ctx context.Context, input types
 	}
 
 	for _, documentID := range input.DocumentIds {
-		if err := r.authorize(ctx, documentID, probo.ActionDocumentVersionPublish); err != nil {
+		if _, err := r.authorize(ctx, documentID, probo.ActionDocumentVersionPublish); err != nil {
 			return nil, err
 		}
 	}
@@ -1182,11 +1178,11 @@ func (r *mutationResolver) BulkPublishDocuments(ctx context.Context, input types
 
 // VoidDocumentVersionApproval is the resolver for the voidDocumentVersionApproval field.
 func (r *mutationResolver) VoidDocumentVersionApproval(ctx context.Context, input types.VoidDocumentVersionApprovalInput) (*types.VoidDocumentVersionApprovalPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionVoidApproval); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionVoidApproval)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	quorum, documentVersion, err := prb.DocumentApprovals.VoidApproval(ctx, scope, input.DocumentVersionID)
@@ -1223,7 +1219,7 @@ func (r *mutationResolver) BulkDeleteDocuments(ctx context.Context, input types.
 	}
 
 	for _, documentID := range input.DocumentIds {
-		if err := r.authorize(ctx, documentID, probo.ActionDocumentDelete); err != nil {
+		if _, err := r.authorize(ctx, documentID, probo.ActionDocumentDelete); err != nil {
 			return nil, err
 		}
 	}
@@ -1231,8 +1227,7 @@ func (r *mutationResolver) BulkDeleteDocuments(ctx context.Context, input types.
 	scope := coredata.NewScopeFromObjectID(input.DocumentIds[0])
 	prb := r.probo
 
-	err := prb.Documents.BulkSoftDelete(ctx, scope, input.DocumentIds)
-	if err != nil {
+	if err := prb.Documents.BulkSoftDelete(ctx, scope, input.DocumentIds); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot bulk delete documents", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -1251,7 +1246,7 @@ func (r *mutationResolver) BulkArchiveDocuments(ctx context.Context, input types
 	}
 
 	for _, documentID := range input.DocumentIds {
-		if err := r.authorize(ctx, documentID, probo.ActionDocumentArchive); err != nil {
+		if _, err := r.authorize(ctx, documentID, probo.ActionDocumentArchive); err != nil {
 			return nil, err
 		}
 	}
@@ -1278,7 +1273,7 @@ func (r *mutationResolver) BulkUnarchiveDocuments(ctx context.Context, input typ
 	}
 
 	for _, documentID := range input.DocumentIds {
-		if err := r.authorize(ctx, documentID, probo.ActionDocumentUnarchive); err != nil {
+		if _, err := r.authorize(ctx, documentID, probo.ActionDocumentUnarchive); err != nil {
 			return nil, err
 		}
 	}
@@ -1305,7 +1300,7 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types.
 
 	// TODO have a way to batch authorize for resources
 	for _, documentID := range input.DocumentIds {
-		if err := r.authorize(ctx, documentID, probo.ActionDocumentVersionExport); err != nil {
+		if _, err := r.authorize(ctx, documentID, probo.ActionDocumentVersionExport); err != nil {
 			return nil, err
 		}
 	}
@@ -1334,11 +1329,11 @@ func (r *mutationResolver) BulkExportDocuments(ctx context.Context, input types.
 
 // GenerateDocumentChangelog is the resolver for the generateDocumentChangelog field.
 func (r *mutationResolver) GenerateDocumentChangelog(ctx context.Context, input types.GenerateDocumentChangelogInput) (*types.GenerateDocumentChangelogPayload, error) {
-	if err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentChangelogGenerate); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentID, probo.ActionDocumentChangelogGenerate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentID)
 	prb := r.probo
 
 	changelog, err := prb.Documents.GenerateChangelog(ctx, scope, input.DocumentID)
@@ -1359,11 +1354,11 @@ func (r *mutationResolver) GenerateDocumentChangelog(ctx context.Context, input
 
 // RequestSignature is the resolver for the requestSignature field.
 func (r *mutationResolver) RequestSignature(ctx context.Context, input types.RequestSignatureInput) (*types.RequestSignaturePayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSignatureRequest)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	documentVersionSignature, err := prb.Documents.RequestSignature(
@@ -1409,7 +1404,7 @@ func (r *mutationResolver) BulkRequestSignatures(ctx context.Context, input type
 	}
 
 	for _, documentID := range input.DocumentIds {
-		if err := r.authorize(ctx, documentID, probo.ActionDocumentVersionSignatureRequest); err != nil {
+		if _, err := r.authorize(ctx, documentID, probo.ActionDocumentVersionSignatureRequest); err != nil {
 			return nil, err
 		}
 	}
@@ -1449,15 +1444,14 @@ func (r *mutationResolver) BulkRequestSignatures(ctx context.Context, input type
 
 // SendSigningNotifications is the resolver for the sendSigningNotifications field.
 func (r *mutationResolver) SendSigningNotifications(ctx context.Context, input types.SendSigningNotificationsInput) (*types.SendSigningNotificationsPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentSendSigningNotifications); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionDocumentSendSigningNotifications)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
-	err := prb.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID)
-	if err != nil {
+	if err := prb.Documents.SendSigningNotifications(ctx, scope, input.OrganizationID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot send signing notifications", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -1469,15 +1463,14 @@ func (r *mutationResolver) SendSigningNotifications(ctx context.Context, input t
 
 // CancelSignatureRequest is the resolver for the cancelSignatureRequest field.
 func (r *mutationResolver) CancelSignatureRequest(ctx context.Context, input types.CancelSignatureRequestInput) (*types.CancelSignatureRequestPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionSignatureID, probo.ActionDocumentVersionCancelSignature)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionSignatureID)
 	prb := r.probo
 
-	err := prb.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID)
-	if err != nil {
+	if err := prb.Documents.CancelSignatureRequest(ctx, scope, input.DocumentVersionSignatureID); err != nil {
 		if errArchived, ok := errors.AsType[*probo.ErrDocumentArchived](err); ok {
 			return nil, gqlutils.Conflict(ctx, errArchived)
 		}
@@ -1494,12 +1487,12 @@ func (r *mutationResolver) CancelSignatureRequest(ctx context.Context, input typ
 
 // SignDocument is the resolver for the signDocument field.
 func (r *mutationResolver) SignDocument(ctx context.Context, input types.SignDocumentInput) (*types.SignDocumentPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSign); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionSign)
+	if err != nil {
 		return nil, err
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	documentVersionSignature, err := prb.Documents.SignDocumentVersionByIdentity(ctx, scope, input.DocumentVersionID, identity.ID)
@@ -1520,7 +1513,8 @@ func (r *mutationResolver) SignDocument(ctx context.Context, input types.SignDoc
 
 // ApproveDocumentVersion is the resolver for the approveDocumentVersion field.
 func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input types.ApproveDocumentVersionInput) (*types.ApproveDocumentVersionPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionApprove); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionApprove)
+	if err != nil {
 		return nil, err
 	}
 
@@ -1532,7 +1526,6 @@ func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input typ
 		signerIP = httpReq.RemoteAddr
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	decision, err := prb.DocumentApprovals.Approve(ctx, scope, probo.ApproveDocumentVersionRequest{
@@ -1573,13 +1566,12 @@ func (r *mutationResolver) ApproveDocumentVersion(ctx context.Context, input typ
 
 // RejectDocumentVersion is the resolver for the rejectDocumentVersion field.
 func (r *mutationResolver) RejectDocumentVersion(ctx context.Context, input types.RejectDocumentVersionInput) (*types.RejectDocumentVersionPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionReject); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionReject)
+	if err != nil {
 		return nil, err
 	}
 
 	identity := authn.IdentityFromContext(ctx)
-
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	decision, err := prb.DocumentApprovals.Reject(ctx, scope, probo.RejectDocumentVersionRequest{
@@ -1616,11 +1608,11 @@ func (r *mutationResolver) RejectDocumentVersion(ctx context.Context, input type
 
 // ExportDocumentVersionPDF is the resolver for the exportDocumentVersionPDF field.
 func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input types.ExportDocumentVersionPDFInput) (*types.ExportDocumentVersionPDFPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionExportPDF); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionDocumentVersionExportPDF)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	watermarkEmail := input.WatermarkEmail
@@ -1648,11 +1640,11 @@ func (r *mutationResolver) ExportDocumentVersionPDF(ctx context.Context, input t
 
 // ExportEmployeeDocumentVersionPDF is the resolver for the exportEmployeeDocumentVersionPDF field.
 func (r *mutationResolver) ExportEmployeeDocumentVersionPDF(ctx context.Context, input types.ExportEmployeeDocumentVersionPDFInput) (*types.ExportEmployeeDocumentVersionPDFPayload, error) {
-	if err := r.authorize(ctx, input.DocumentVersionID, probo.ActionEmployeeDocumentVersionExportPDF); err != nil {
+	scope, err := r.authorize(ctx, input.DocumentVersionID, probo.ActionEmployeeDocumentVersionExportPDF)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.DocumentVersionID)
 	prb := r.probo
 
 	documentVersion, err := prb.Documents.GetVersion(ctx, scope, input.DocumentVersionID)

pkg/server/api/console/v1/evidence_resolvers.go

@@ -22,7 +22,7 @@ import (
 
 // File is the resolver for the file field.
 func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*types.File, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil {
 		return nil, err
 	}
 
@@ -48,7 +48,7 @@ func (r *evidenceResolver) File(ctx context.Context, obj *types.Evidence) (*type
 
 // Task is the resolver for the task field.
 func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*types.Task, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTaskGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionTaskGet); err != nil {
 		return nil, err
 	}
 
@@ -75,7 +75,7 @@ func (r *evidenceResolver) Task(ctx context.Context, obj *types.Evidence) (*type
 
 // Measure is the resolver for the measure field.
 func (r *evidenceResolver) Measure(ctx context.Context, obj *types.Evidence) (*types.Measure, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil {
 		return nil, err
 	}
 
@@ -102,11 +102,11 @@ func (r *evidenceResolver) Permission(ctx context.Context, obj *types.Evidence,
 
 // TotalCount is the resolver for the totalCount field.
 func (r *evidenceConnectionResolver) TotalCount(ctx context.Context, obj *types.EvidenceConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionEvidenceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionEvidenceList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -135,15 +135,14 @@ func (r *evidenceConnectionResolver) TotalCount(ctx context.Context, obj *types.
 
 // DeleteEvidence is the resolver for the deleteEvidence field.
 func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.DeleteEvidenceInput) (*types.DeleteEvidencePayload, error) {
-	if err := r.authorize(ctx, input.EvidenceID, probo.ActionEvidenceDelete); err != nil {
+	scope, err := r.authorize(ctx, input.EvidenceID, probo.ActionEvidenceDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.EvidenceID)
 	prb := r.probo
 
-	err := prb.Evidences.Delete(ctx, scope, input.EvidenceID)
-	if err != nil {
+	if err := prb.Evidences.Delete(ctx, scope, input.EvidenceID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete evidence", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -155,11 +154,11 @@ func (r *mutationResolver) DeleteEvidence(ctx context.Context, input types.Delet
 
 // UploadMeasureEvidence is the resolver for the uploadMeasureEvidence field.
 func (r *mutationResolver) UploadMeasureEvidence(ctx context.Context, input types.UploadMeasureEvidenceInput) (*types.UploadMeasureEvidencePayload, error) {
-	if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureEvidenceUpload); err != nil {
+	scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureEvidenceUpload)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.MeasureID)
 	prb := r.probo
 
 	evidence, err := prb.Evidences.UploadMeasureEvidence(

pkg/server/api/console/v1/file_resolvers.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/probo"
 	"go.probo.inc/probo/pkg/server/api/console/v1/schema"
 	"go.probo.inc/probo/pkg/server/api/console/v1/types"
@@ -19,11 +18,11 @@ import (
 
 // DownloadURL is the resolver for the downloadUrl field.
 func (r *fileResolver) DownloadURL(ctx context.Context, obj *types.File) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	downloadUrl, err := prb.Files.GenerateFileTempURL(ctx, scope, obj.ID, 60*time.Second)

pkg/server/api/console/v1/framework_resolvers.go

@@ -26,7 +26,7 @@ import (
 
 // Organization is the resolver for the organization field.
 func (r *frameworkResolver) Organization(ctx context.Context, obj *types.Framework) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -48,11 +48,11 @@ func (r *frameworkResolver) Organization(ctx context.Context, obj *types.Framewo
 
 // Controls is the resolver for the controls field.
 func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
@@ -84,11 +84,11 @@ func (r *frameworkResolver) Controls(ctx context.Context, obj *types.Framework,
 
 // LightLogoURL is the resolver for the lightLogoURL field.
 func (r *frameworkResolver) LightLogoURL(ctx context.Context, obj *types.Framework) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	return prb.Frameworks.GenerateLightLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -96,11 +96,11 @@ func (r *frameworkResolver) LightLogoURL(ctx context.Context, obj *types.Framewo
 
 // DarkLogoURL is the resolver for the darkLogoURL field.
 func (r *frameworkResolver) DarkLogoURL(ctx context.Context, obj *types.Framework) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	return prb.Frameworks.GenerateDarkLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -113,13 +113,13 @@ func (r *frameworkResolver) Permission(ctx context.Context, obj *types.Framework
 
 // TotalCount is the resolver for the totalCount field.
 func (r *frameworkConnectionResolver) TotalCount(ctx context.Context, obj *types.FrameworkConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionFrameworkList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionFrameworkList)
+	if err != nil {
 		return 0, err
 	}
 
 	switch obj.Resolver.(type) {
 	case *organizationResolver:
-		scope := coredata.NewScopeFromObjectID(obj.ParentID)
 		prb := r.probo
 
 		count, err := prb.Frameworks.CountForOrganizationID(ctx, scope, obj.ParentID)
@@ -138,11 +138,11 @@ func (r *frameworkConnectionResolver) TotalCount(ctx context.Context, obj *types
 
 // CreateFramework is the resolver for the createFramework field.
 func (r *mutationResolver) CreateFramework(ctx context.Context, input types.CreateFrameworkInput) (*types.CreateFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	framework, err := prb.Frameworks.Create(
@@ -169,11 +169,11 @@ func (r *mutationResolver) CreateFramework(ctx context.Context, input types.Crea
 
 // UpdateFramework is the resolver for the updateFramework field.
 func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.UpdateFrameworkInput) (*types.UpdateFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionFrameworkUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionFrameworkUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	framework, err := prb.Frameworks.Update(
@@ -201,11 +201,11 @@ func (r *mutationResolver) UpdateFramework(ctx context.Context, input types.Upda
 
 // ImportFramework is the resolver for the importFramework field.
 func (r *mutationResolver) ImportFramework(ctx context.Context, input types.ImportFrameworkInput) (*types.ImportFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkImport); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionFrameworkImport)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.ImportFrameworkRequest{}
@@ -232,15 +232,14 @@ func (r *mutationResolver) ImportFramework(ctx context.Context, input types.Impo
 
 // DeleteFramework is the resolver for the deleteFramework field.
 func (r *mutationResolver) DeleteFramework(ctx context.Context, input types.DeleteFrameworkInput) (*types.DeleteFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkDelete); err != nil {
+	scope, err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.FrameworkID)
 	prb := r.probo
 
-	err := prb.Frameworks.Delete(ctx, scope, input.FrameworkID)
-	if err != nil {
+	if err := prb.Frameworks.Delete(ctx, scope, input.FrameworkID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete framework", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -252,11 +251,11 @@ func (r *mutationResolver) DeleteFramework(ctx context.Context, input types.Dele
 
 // ExportFramework is the resolver for the exportFramework field.
 func (r *mutationResolver) ExportFramework(ctx context.Context, input types.ExportFrameworkInput) (*types.ExportFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkExport); err != nil {
+	scope, err := r.authorize(ctx, input.FrameworkID, probo.ActionFrameworkExport)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.FrameworkID)
 	prb := r.probo
 
 	identity := authn.IdentityFromContext(ctx)

pkg/server/api/console/v1/mailing_list_resolvers.go

@@ -23,7 +23,7 @@ import (
 
 // Subscribers is the resolver for the subscribers field on MailingList.
 func (r *mailingListResolver) Subscribers(ctx context.Context, obj *types.MailingList, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.MailingListSubscriberConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList); err != nil {
 		return nil, err
 	}
 
@@ -45,7 +45,7 @@ func (r *mailingListResolver) Subscribers(ctx context.Context, obj *types.Mailin
 
 // Updates is the resolver for the updates field on MailingList.
 func (r *mailingListResolver) Updates(ctx context.Context, obj *types.MailingList, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.MailingListUpdateConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMailingListUpdateList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionMailingListUpdateList); err != nil {
 		return nil, err
 	}
 
@@ -67,7 +67,7 @@ func (r *mailingListResolver) Updates(ctx context.Context, obj *types.MailingLis
 
 // TotalCount is the resolver for the totalCount field.
 func (r *mailingListSubscriberConnectionResolver) TotalCount(ctx context.Context, obj *types.MailingListSubscriberConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListSubscriberList); err != nil {
+	if _, err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListSubscriberList); err != nil {
 		return 0, err
 	}
 
@@ -89,7 +89,7 @@ func (r *mailingListSubscriberConnectionResolver) TotalCount(ctx context.Context
 
 // TotalCount is the resolver for the totalCount field on MailingListUpdateConnection.
 func (r *mailingListUpdateConnectionResolver) TotalCount(ctx context.Context, obj *types.MailingListUpdateConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListUpdateList); err != nil {
+	if _, err := r.authorize(ctx, obj.ParentID, probo.ActionMailingListUpdateList); err != nil {
 		return 0, err
 	}
 
@@ -104,7 +104,7 @@ func (r *mailingListUpdateConnectionResolver) TotalCount(ctx context.Context, ob
 
 // CreateMailingListUpdate is the resolver for the createMailingListUpdate field.
 func (r *mutationResolver) CreateMailingListUpdate(ctx context.Context, input types.CreateMailingListUpdateInput) (*types.CreateMailingListUpdatePayload, error) {
-	if err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListUpdateCreate); err != nil {
+	if _, err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListUpdateCreate); err != nil {
 		return nil, err
 	}
 
@@ -133,7 +133,7 @@ func (r *mutationResolver) CreateMailingListUpdate(ctx context.Context, input ty
 
 // UpdateMailingListUpdate is the resolver for the updateMailingListUpdate field.
 func (r *mutationResolver) UpdateMailingListUpdate(ctx context.Context, input types.UpdateMailingListUpdateInput) (*types.UpdateMailingListUpdatePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil {
 		return nil, err
 	}
 
@@ -170,7 +170,7 @@ func (r *mutationResolver) UpdateMailingListUpdate(ctx context.Context, input ty
 
 // SendMailingListUpdate is the resolver for the sendMailingListUpdate field.
 func (r *mutationResolver) SendMailingListUpdate(ctx context.Context, input types.SendMailingListUpdateInput) (*types.SendMailingListUpdatePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateUpdate); err != nil {
 		return nil, err
 	}
 
@@ -196,7 +196,7 @@ func (r *mutationResolver) SendMailingListUpdate(ctx context.Context, input type
 
 // DeleteMailingListUpdate is the resolver for the deleteMailingListUpdate field.
 func (r *mutationResolver) DeleteMailingListUpdate(ctx context.Context, input types.DeleteMailingListUpdateInput) (*types.DeleteMailingListUpdatePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateDelete); err != nil {
+	if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdateDelete); err != nil {
 		return nil, err
 	}
 
@@ -217,7 +217,7 @@ func (r *mutationResolver) DeleteMailingListUpdate(ctx context.Context, input ty
 
 // UpdateMailingList is the resolver for the updateMailingList field.
 func (r *mutationResolver) UpdateMailingList(ctx context.Context, input types.UpdateMailingListInput) (*types.UpdateMailingListPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListUpdate); err != nil {
 		return nil, err
 	}
 
@@ -234,7 +234,7 @@ func (r *mutationResolver) UpdateMailingList(ctx context.Context, input types.Up
 
 // CreateMailingListSubscriber is the resolver for the createMailingListSubscriber field.
 func (r *mutationResolver) CreateMailingListSubscriber(ctx context.Context, input types.CreateMailingListSubscriberInput) (*types.CreateMailingListSubscriberPayload, error) {
-	if err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListSubscriberCreate); err != nil {
+	if _, err := r.authorize(ctx, input.MailingListID, probo.ActionMailingListSubscriberCreate); err != nil {
 		return nil, err
 	}
 
@@ -268,7 +268,7 @@ func (r *mutationResolver) CreateMailingListSubscriber(ctx context.Context, inpu
 
 // DeleteMailingListSubscriber is the resolver for the deleteMailingListSubscriber field.
 func (r *mutationResolver) DeleteMailingListSubscriber(ctx context.Context, input types.DeleteMailingListSubscriberInput) (*types.DeleteMailingListSubscriberPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionMailingListSubscriberDelete); err != nil {
+	if _, err := r.authorize(ctx, input.ID, probo.ActionMailingListSubscriberDelete); err != nil {
 		return nil, err
 	}
 

pkg/server/api/console/v1/measure_resolvers.go

@@ -22,11 +22,11 @@ import (
 
 // Evidences is the resolver for the evidences field.
 func (r *measureResolver) Evidences(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.EvidenceOrderBy) (*types.EvidenceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.EvidenceOrderField]{
@@ -53,11 +53,11 @@ func (r *measureResolver) Evidences(ctx context.Context, obj *types.Measure, fir
 
 // Tasks is the resolver for the tasks field.
 func (r *measureResolver) Tasks(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTaskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTaskList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TaskOrderField]{
@@ -84,11 +84,11 @@ func (r *measureResolver) Tasks(ctx context.Context, obj *types.Measure, first *
 
 // Risks is the resolver for the risks field.
 func (r *measureResolver) Risks(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy, filter *types.RiskFilter) (*types.RiskConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.RiskOrderField]{
@@ -120,11 +120,11 @@ func (r *measureResolver) Risks(ctx context.Context, obj *types.Measure, first *
 
 // Controls is the resolver for the controls field.
 func (r *measureResolver) Controls(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
@@ -156,11 +156,11 @@ func (r *measureResolver) Controls(ctx context.Context, obj *types.Measure, firs
 
 // Documents is the resolver for the documents field.
 func (r *measureResolver) Documents(ctx context.Context, obj *types.Measure, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
@@ -200,11 +200,11 @@ func (r *measureResolver) Permission(ctx context.Context, obj *types.Measure, ac
 
 // TotalCount is the resolver for the totalCount field.
 func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.MeasureConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionMeasureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionMeasureList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -241,11 +241,11 @@ func (r *measureConnectionResolver) TotalCount(ctx context.Context, obj *types.M
 
 // // CreateMeasure is the resolver for the createMeasure field.
 func (r *mutationResolver) CreateMeasure(ctx context.Context, input types.CreateMeasureInput) (*types.CreateMeasurePayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	measure, err := prb.Measures.Create(
@@ -278,11 +278,11 @@ func (r *mutationResolver) CreateMeasure(ctx context.Context, input types.Create
 
 // UpdateMeasure is the resolver for the updateMeasure field.
 func (r *mutationResolver) UpdateMeasure(ctx context.Context, input types.UpdateMeasureInput) (*types.UpdateMeasurePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionMeasureUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionMeasureUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	measure, err := prb.Measures.Update(
@@ -312,11 +312,11 @@ func (r *mutationResolver) UpdateMeasure(ctx context.Context, input types.Update
 
 // ImportMeasure is the resolver for the importMeasure field.
 func (r *mutationResolver) ImportMeasure(ctx context.Context, input types.ImportMeasureInput) (*types.ImportMeasurePayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureImport); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionMeasureImport)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	var req probo.ImportMeasureRequest
@@ -343,15 +343,14 @@ func (r *mutationResolver) ImportMeasure(ctx context.Context, input types.Import
 
 // DeleteMeasure is the resolver for the deleteMeasure field.
 func (r *mutationResolver) DeleteMeasure(ctx context.Context, input types.DeleteMeasureInput) (*types.DeleteMeasurePayload, error) {
-	if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDelete); err != nil {
+	scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.MeasureID)
 	prb := r.probo
 
-	err := prb.Measures.Delete(ctx, scope, input.MeasureID)
-	if err != nil {
+	if err := prb.Measures.Delete(ctx, scope, input.MeasureID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete measure", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -363,11 +362,11 @@ func (r *mutationResolver) DeleteMeasure(ctx context.Context, input types.Delete
 
 // CreateMeasureDocumentMapping is the resolver for the createMeasureDocumentMapping field.
 func (r *mutationResolver) CreateMeasureDocumentMapping(ctx context.Context, input types.CreateMeasureDocumentMappingInput) (*types.CreateMeasureDocumentMappingPayload, error) {
-	if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.MeasureID)
 	prb := r.probo
 
 	measure, document, err := prb.Measures.CreateDocumentMapping(ctx, scope, input.MeasureID, input.DocumentID)
@@ -389,11 +388,11 @@ func (r *mutationResolver) CreateMeasureDocumentMapping(ctx context.Context, inp
 
 // DeleteMeasureDocumentMapping is the resolver for the deleteMeasureDocumentMapping field.
 func (r *mutationResolver) DeleteMeasureDocumentMapping(ctx context.Context, input types.DeleteMeasureDocumentMappingInput) (*types.DeleteMeasureDocumentMappingPayload, error) {
-	if err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.MeasureID, probo.ActionMeasureDocumentMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.MeasureID)
 	prb := r.probo
 
 	measure, document, err := prb.Measures.DeleteDocumentMapping(ctx, scope, input.MeasureID, input.DocumentID)

pkg/server/api/console/v1/obligation_resolvers.go

@@ -23,11 +23,11 @@ import (
 
 // CreateObligation is the resolver for the createObligation field.
 func (r *mutationResolver) CreateObligation(ctx context.Context, input types.CreateObligationInput) (*types.CreateObligationPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.CreateObligationRequest{
@@ -62,11 +62,11 @@ func (r *mutationResolver) CreateObligation(ctx context.Context, input types.Cre
 
 // UpdateObligation is the resolver for the updateObligation field.
 func (r *mutationResolver) UpdateObligation(ctx context.Context, input types.UpdateObligationInput) (*types.UpdateObligationPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionObligationUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionObligationUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateObligationRequest{
@@ -101,15 +101,14 @@ func (r *mutationResolver) UpdateObligation(ctx context.Context, input types.Upd
 
 // DeleteObligation is the resolver for the deleteObligation field.
 func (r *mutationResolver) DeleteObligation(ctx context.Context, input types.DeleteObligationInput) (*types.DeleteObligationPayload, error) {
-	if err := r.authorize(ctx, input.ObligationID, probo.ActionObligationDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ObligationID, probo.ActionObligationDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ObligationID)
 	prb := r.probo
 
-	err := prb.Obligations.Delete(ctx, scope, input.ObligationID)
-	if err != nil {
+	if err := prb.Obligations.Delete(ctx, scope, input.ObligationID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete obligation", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -121,11 +120,11 @@ func (r *mutationResolver) DeleteObligation(ctx context.Context, input types.Del
 
 // PublishObligationList is the resolver for the publishObligationList field.
 func (r *mutationResolver) PublishObligationList(ctx context.Context, input types.PublishObligationListInput) (*types.PublishObligationListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionObligationPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishObligationList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -151,7 +150,7 @@ func (r *mutationResolver) PublishObligationList(ctx context.Context, input type
 
 // Organization is the resolver for the organization field.
 func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obligation) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -173,7 +172,7 @@ func (r *obligationResolver) Organization(ctx context.Context, obj *types.Obliga
 
 // Owner is the resolver for the owner field.
 func (r *obligationResolver) Owner(ctx context.Context, obj *types.Obligation) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -200,11 +199,11 @@ func (r *obligationResolver) Permission(ctx context.Context, obj *types.Obligati
 
 // TotalCount is the resolver for the totalCount field.
 func (r *obligationConnectionResolver) TotalCount(ctx context.Context, obj *types.ObligationConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionObligationList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionObligationList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/console/v1/organization_resolvers.go

@@ -28,11 +28,11 @@ import (
 
 // UpdateOrganizationContext is the resolver for the updateOrganizationContext field.
 func (r *mutationResolver) UpdateOrganizationContext(ctx context.Context, input types.UpdateOrganizationContextInput) (*types.UpdateOrganizationContextPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionOrganizationContextUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.UpdateOrganizationContextRequest{
@@ -62,11 +62,11 @@ func (r *mutationResolver) UpdateOrganizationContext(ctx context.Context, input
 
 // LogoURL is the resolver for the logoUrl field.
 func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetLogoUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetLogoUrl)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	logoURL, err := prb.Organizations.GenerateLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -80,11 +80,11 @@ func (r *organizationResolver) LogoURL(ctx context.Context, obj *types.Organizat
 
 // HorizontalLogoURL is the resolver for the horizontalLogoUrl field.
 func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types.Organization) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetHorizontalLogoUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGetHorizontalLogoUrl)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	horizontalLogoURL, err := prb.Organizations.GenerateHorizontalLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -98,11 +98,11 @@ func (r *organizationResolver) HorizontalLogoURL(ctx context.Context, obj *types
 
 // Context is the resolver for the context field.
 func (r *organizationResolver) Context(ctx context.Context, obj *types.Organization) (*types.OrganizationContext, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationContextGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationContextGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	orgContext, err := prb.Organizations.GetContext(ctx, scope, obj.ID)
@@ -116,7 +116,7 @@ func (r *organizationResolver) Context(ctx context.Context, obj *types.Organizat
 
 // Profiles is the resolver for the profiles field.
 func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProfileOrderBy, filter *types.ProfileFilter) (*types.ProfileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileList); err != nil {
 		return nil, err
 	}
 
@@ -157,11 +157,11 @@ func (r *organizationResolver) Profiles(ctx context.Context, obj *types.Organiza
 
 // MeasureCategories is the resolver for the measureCategories field.
 func (r *organizationResolver) MeasureCategories(ctx context.Context, obj *types.Organization) ([]string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	categories, err := prb.Measures.ListDistinctCategoriesForOrganizationID(ctx, scope, obj.ID)
@@ -175,12 +175,11 @@ func (r *organizationResolver) MeasureCategories(ctx context.Context, obj *types
 
 // AccessSources is the resolver for the accessSources field.
 func (r *organizationResolver) AccessSources(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessSourceOrder) (*types.AccessSourceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessSourceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.AccessSourceOrderField]{
 		Field:     coredata.AccessSourceOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -204,12 +203,11 @@ func (r *organizationResolver) AccessSources(ctx context.Context, obj *types.Org
 
 // AccessReviewCampaigns is the resolver for the accessReviewCampaigns field.
 func (r *organizationResolver) AccessReviewCampaigns(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AccessReviewCampaignOrder) (*types.AccessReviewCampaignConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAccessReviewCampaignList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAccessReviewCampaignList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.AccessReviewCampaignOrderField]{
 		Field:     coredata.AccessReviewCampaignOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -233,11 +231,11 @@ func (r *organizationResolver) AccessReviewCampaigns(ctx context.Context, obj *t
 
 // AssetListDocument is the resolver for the assetListDocument field.
 func (r *organizationResolver) AssetListDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	assetDocumentID, err := prb.GeneratedDocuments.GetAssetListDocumentID(ctx, scope, obj.ID)
@@ -259,11 +257,11 @@ func (r *organizationResolver) AssetListDocument(ctx context.Context, obj *types
 
 // Assets is the resolver for the assets field.
 func (r *organizationResolver) Assets(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AssetOrderBy) (*types.AssetConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAssetList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAssetList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.AssetOrderField]{
@@ -290,11 +288,11 @@ func (r *organizationResolver) Assets(ctx context.Context, obj *types.Organizati
 
 // DataListDocument is the resolver for the dataListDocument field.
 func (r *organizationResolver) DataListDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	dataDocumentID, err := prb.GeneratedDocuments.GetDataListDocumentID(ctx, scope, obj.ID)
@@ -316,11 +314,11 @@ func (r *organizationResolver) DataListDocument(ctx context.Context, obj *types.
 
 // Data is the resolver for the data field.
 func (r *organizationResolver) Data(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DatumOrderBy) (*types.DatumConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDatumList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDatumList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DatumOrderField]{
@@ -347,11 +345,11 @@ func (r *organizationResolver) Data(ctx context.Context, obj *types.Organization
 
 // Audits is the resolver for the audits field.
 func (r *organizationResolver) Audits(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditOrderBy) (*types.AuditConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionAuditList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionAuditList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.AuditOrderField]{
@@ -378,11 +376,11 @@ func (r *organizationResolver) Audits(ctx context.Context, obj *types.Organizati
 
 // FindingsDocument is the resolver for the findingsDocument field.
 func (r *organizationResolver) FindingsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	findingDocumentID, err := prb.GeneratedDocuments.GetFindingsDocumentID(ctx, scope, obj.ID)
@@ -404,11 +402,11 @@ func (r *organizationResolver) FindingsDocument(ctx context.Context, obj *types.
 
 // Findings is the resolver for the findings field.
 func (r *organizationResolver) Findings(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FindingOrder, filter *types.FindingFilter) (*types.FindingConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFindingList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFindingList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.FindingOrderField]{
@@ -451,7 +449,7 @@ func (r *organizationResolver) Findings(ctx context.Context, obj *types.Organiza
 
 // AuditLogEntries is the resolver for the auditLogEntries field.
 func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.AuditLogEntryOrderBy, filter *types.AuditLogEntryFilter) (*types.AuditLogEntryConnection, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionAuditLogEntryList); err != nil {
 		return nil, err
 	}
 
@@ -499,11 +497,11 @@ func (r *organizationResolver) AuditLogEntries(ctx context.Context, obj *types.O
 
 // SlackConnections is the resolver for the slackConnections field.
 func (r *organizationResolver) SlackConnections(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SlackConnectionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionSlackConnectionList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionSlackConnectionList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	slackProvider := coredata.ConnectorProviderSlack
@@ -532,11 +530,11 @@ func (r *organizationResolver) SlackOAuth2Scopes(ctx context.Context, obj *types
 
 // Connectors is the resolver for the connectors field.
 func (r *organizationResolver) Connectors(ctx context.Context, obj *types.Organization, filter *types.ConnectorFilter) ([]*types.Connector, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionConnectorList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionConnectorList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	connectors, err := prb.Connectors.ListAllForOrganizationID(ctx, scope, obj.ID)
@@ -565,7 +563,7 @@ func (r *organizationResolver) Connectors(ctx context.Context, obj *types.Organi
 
 // ConnectorProviderInfos is the resolver for the connectorProviderInfos field.
 func (r *organizationResolver) ConnectorProviderInfos(ctx context.Context, obj *types.Organization) ([]*types.ConnectorProviderInfo, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionConnectorList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionConnectorList); err != nil {
 		return nil, err
 	}
 
@@ -596,11 +594,11 @@ func (r *organizationResolver) ConnectorProviderInfos(ctx context.Context, obj *
 
 // Controls is the resolver for the controls field.
 func (r *organizationResolver) Controls(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
@@ -632,11 +630,11 @@ func (r *organizationResolver) Controls(ctx context.Context, obj *types.Organiza
 
 // StatementsOfApplicability is the resolver for the statementsOfApplicability field.
 func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.StatementOfApplicabilityOrderBy) (*types.StatementOfApplicabilityConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionStatementOfApplicabilityList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionStatementOfApplicabilityList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.StatementOfApplicabilityOrderField]{
@@ -663,11 +661,11 @@ func (r *organizationResolver) StatementsOfApplicability(ctx context.Context, ob
 
 // DataProtectionImpactAssessments is the resolver for the dataProtectionImpactAssessments field.
 func (r *organizationResolver) DataProtectionImpactAssessments(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DataProtectionImpactAssessmentOrderBy) (*types.DataProtectionImpactAssessmentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DataProtectionImpactAssessmentOrderField]{
@@ -695,11 +693,11 @@ func (r *organizationResolver) DataProtectionImpactAssessments(ctx context.Conte
 
 // DataProtectionImpactAssessmentsDocument is the resolver for the dataProtectionImpactAssessmentsDocument field.
 func (r *organizationResolver) DataProtectionImpactAssessmentsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentID, err := prb.GeneratedDocuments.GetDataProtectionImpactAssessmentsDocumentID(ctx, scope, obj.ID)
@@ -728,11 +726,11 @@ func (r *organizationResolver) DataProtectionImpactAssessmentsDocument(ctx conte
 
 // TransferImpactAssessments is the resolver for the transferImpactAssessments field.
 func (r *organizationResolver) TransferImpactAssessments(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TransferImpactAssessmentOrderBy) (*types.TransferImpactAssessmentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TransferImpactAssessmentOrderField]{
@@ -760,11 +758,11 @@ func (r *organizationResolver) TransferImpactAssessments(ctx context.Context, ob
 
 // TransferImpactAssessmentsDocument is the resolver for the transferImpactAssessmentsDocument field.
 func (r *organizationResolver) TransferImpactAssessmentsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentID, err := prb.GeneratedDocuments.GetTransferImpactAssessmentsDocumentID(ctx, scope, obj.ID)
@@ -793,11 +791,11 @@ func (r *organizationResolver) TransferImpactAssessmentsDocument(ctx context.Con
 
 // Documents is the resolver for the documents field.
 func (r *organizationResolver) Documents(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
@@ -838,11 +836,11 @@ func (r *organizationResolver) Evidences(ctx context.Context, obj *types.Organiz
 
 // Frameworks is the resolver for the frameworks field.
 func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.FrameworkOrderBy) (*types.FrameworkConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFrameworkList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFrameworkList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.FrameworkOrderField]{
@@ -869,11 +867,11 @@ func (r *organizationResolver) Frameworks(ctx context.Context, obj *types.Organi
 
 // Measures is the resolver for the measures field.
 func (r *organizationResolver) Measures(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{
@@ -905,11 +903,11 @@ func (r *organizationResolver) Measures(ctx context.Context, obj *types.Organiza
 
 // ObligationsDocument is the resolver for the obligationsDocument field.
 func (r *organizationResolver) ObligationsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	obligationDocumentID, err := prb.GeneratedDocuments.GetObligationsDocumentID(ctx, scope, obj.ID)
@@ -931,11 +929,11 @@ func (r *organizationResolver) ObligationsDocument(ctx context.Context, obj *typ
 
 // Obligations is the resolver for the obligations field.
 func (r *organizationResolver) Obligations(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionObligationList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{
@@ -963,11 +961,11 @@ func (r *organizationResolver) Obligations(ctx context.Context, obj *types.Organ
 
 // ProcessingActivities is the resolver for the processingActivities field.
 func (r *organizationResolver) ProcessingActivities(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ProcessingActivityOrderBy) (*types.ProcessingActivityConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionProcessingActivityList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ProcessingActivityOrderField]{
@@ -995,11 +993,11 @@ func (r *organizationResolver) ProcessingActivities(ctx context.Context, obj *ty
 
 // ProcessingActivitiesDocument is the resolver for the processingActivitiesDocument field.
 func (r *organizationResolver) ProcessingActivitiesDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentID, err := prb.GeneratedDocuments.GetProcessingActivitiesDocumentID(ctx, scope, obj.ID)
@@ -1028,11 +1026,11 @@ func (r *organizationResolver) ProcessingActivitiesDocument(ctx context.Context,
 
 // RightsRequests is the resolver for the rightsRequests field.
 func (r *organizationResolver) RightsRequests(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RightsRequestOrderBy) (*types.RightsRequestConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRightsRequestList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRightsRequestList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.RightsRequestOrderField]{
@@ -1060,11 +1058,11 @@ func (r *organizationResolver) RightsRequests(ctx context.Context, obj *types.Or
 
 // Risks is the resolver for the risks field.
 func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy, filter *types.RiskFilter) (*types.RiskConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.RiskOrderField]{
@@ -1096,11 +1094,11 @@ func (r *organizationResolver) Risks(ctx context.Context, obj *types.Organizatio
 
 // RisksDocument is the resolver for the risksDocument field.
 func (r *organizationResolver) RisksDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentID, err := prb.GeneratedDocuments.GetRisksDocumentID(ctx, scope, obj.ID)
@@ -1129,12 +1127,11 @@ func (r *organizationResolver) RisksDocument(ctx context.Context, obj *types.Org
 
 // RiskAssessments is the resolver for the riskAssessments field.
 func (r *organizationResolver) RiskAssessments(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentOrderBy) (*types.RiskAssessmentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentOrderField]{
 		Field:     coredata.RiskAssessmentOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -1159,12 +1156,11 @@ func (r *organizationResolver) RiskAssessments(ctx context.Context, obj *types.O
 
 // RiskAssessmentScenarios is the resolver for the riskAssessmentScenarios field.
 func (r *organizationResolver) RiskAssessmentScenarios(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{
 		Field:     coredata.RiskAssessmentScenarioOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -1189,11 +1185,11 @@ func (r *organizationResolver) RiskAssessmentScenarios(ctx context.Context, obj
 
 // Tasks is the resolver for the tasks field.
 func (r *organizationResolver) Tasks(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.TaskOrderBy) (*types.TaskConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTaskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTaskList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TaskOrderField]{
@@ -1220,11 +1216,11 @@ func (r *organizationResolver) Tasks(ctx context.Context, obj *types.Organizatio
 
 // TrustCenter is the resolver for the trustCenter field.
 func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organization) (*types.TrustCenter, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	trustCenter, err := prb.TrustCenters.GetByOrganizationID(ctx, scope, obj.ID)
@@ -1247,11 +1243,11 @@ func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organ
 
 // CustomDomain is the resolver for the customDomain field.
 func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Organization) (*types.CustomDomain, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCustomDomainGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionCustomDomainGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	domain, err := prb.CustomDomains.GetOrganizationCustomDomain(ctx, scope, obj.ID)
@@ -1269,11 +1265,11 @@ func (r *organizationResolver) CustomDomain(ctx context.Context, obj *types.Orga
 
 // TrustCenterFiles is the resolver for the trustCenterFiles field.
 func (r *organizationResolver) TrustCenterFiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterFileOrderField]) (*types.TrustCenterFileConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TrustCenterFileOrderField]{
@@ -1300,7 +1296,8 @@ func (r *organizationResolver) TrustCenterFiles(ctx context.Context, obj *types.
 
 // CookieBanners is the resolver for the cookieBanners field.
 func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.CookieBannerOrderBy) (*types.CookieBannerConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionCookieBannerList)
+	if err != nil {
 		return nil, err
 	}
 
@@ -1316,7 +1313,6 @@ func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Org
 	}
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 
 	banners, err := r.cookieBanner.ListCookieBannersForOrganization(ctx, scope, obj.ID, cursor, coredata.NewCookieBannerFilter(nil))
 	if err != nil {
@@ -1331,11 +1327,11 @@ func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Org
 
 // ThirdParties is the resolver for the thirdParties field.
 func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
@@ -1364,11 +1360,11 @@ func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Orga
 
 // ThirdPartiesDocument is the resolver for the thirdPartiesDocument field.
 func (r *organizationResolver) ThirdPartiesDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	documentID, err := prb.GeneratedDocuments.GetThirdPartiesDocumentID(ctx, scope, obj.ID)
@@ -1397,11 +1393,11 @@ func (r *organizationResolver) ThirdPartiesDocument(ctx context.Context, obj *ty
 
 // WebhookSubscriptions is the resolver for the webhookSubscriptions field.
 func (r *organizationResolver) WebhookSubscriptions(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.WebhookSubscriptionOrderBy) (*types.WebhookSubscriptionConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.WebhookSubscriptionOrderField]{
@@ -1438,7 +1434,7 @@ func (r *profileResolver) Permission(ctx context.Context, obj *types.Profile, ac
 
 // TotalCount is the resolver for the totalCount field.
 func (r *profileConnectionResolver) TotalCount(ctx context.Context, obj *types.ProfileConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, iam.ActionMembershipProfileList); err != nil {
+	if _, err := r.authorize(ctx, obj.ParentID, iam.ActionMembershipProfileList); err != nil {
 		return 0, err
 	}
 

pkg/server/api/console/v1/processing_activity_resolvers.go

@@ -23,11 +23,11 @@ import (
 
 // CreateProcessingActivity is the resolver for the createProcessingActivity field.
 func (r *mutationResolver) CreateProcessingActivity(ctx context.Context, input types.CreateProcessingActivityInput) (*types.CreateProcessingActivityPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.CreateProcessingActivityRequest{
@@ -66,11 +66,11 @@ func (r *mutationResolver) CreateProcessingActivity(ctx context.Context, input t
 
 // UpdateProcessingActivity is the resolver for the updateProcessingActivity field.
 func (r *mutationResolver) UpdateProcessingActivity(ctx context.Context, input types.UpdateProcessingActivityInput) (*types.UpdateProcessingActivityPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionProcessingActivityUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionProcessingActivityUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateProcessingActivityRequest{
@@ -109,15 +109,14 @@ func (r *mutationResolver) UpdateProcessingActivity(ctx context.Context, input t
 
 // DeleteProcessingActivity is the resolver for the deleteProcessingActivity field.
 func (r *mutationResolver) DeleteProcessingActivity(ctx context.Context, input types.DeleteProcessingActivityInput) (*types.DeleteProcessingActivityPayload, error) {
-	if err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionProcessingActivityDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ProcessingActivityID, probo.ActionProcessingActivityDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ProcessingActivityID)
 	prb := r.probo
 
-	err := prb.ProcessingActivities.Delete(ctx, scope, input.ProcessingActivityID)
-	if err != nil {
+	if err := prb.ProcessingActivities.Delete(ctx, scope, input.ProcessingActivityID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete processing activity", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -129,11 +128,11 @@ func (r *mutationResolver) DeleteProcessingActivity(ctx context.Context, input t
 
 // PublishProcessingActivityList is the resolver for the publishProcessingActivityList field.
 func (r *mutationResolver) PublishProcessingActivityList(ctx context.Context, input types.PublishProcessingActivityListInput) (*types.PublishProcessingActivityListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionProcessingActivityPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishProcessingActivityList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -159,7 +158,7 @@ func (r *mutationResolver) PublishProcessingActivityList(ctx context.Context, in
 
 // Organization is the resolver for the organization field.
 func (r *processingActivityResolver) Organization(ctx context.Context, obj *types.ProcessingActivity) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -181,7 +180,7 @@ func (r *processingActivityResolver) Organization(ctx context.Context, obj *type
 
 // DataProtectionOfficer is the resolver for the dataProtectionOfficer field.
 func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context, obj *types.ProcessingActivity) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -207,11 +206,11 @@ func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context,
 
 // ThirdParties is the resolver for the thirdParties field.
 func (r *processingActivityResolver) ThirdParties(ctx context.Context, obj *types.ProcessingActivity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
@@ -238,11 +237,11 @@ func (r *processingActivityResolver) ThirdParties(ctx context.Context, obj *type
 
 // DataProtectionImpactAssessment is the resolver for the dataProtectionImpactAssessment field.
 func (r *processingActivityResolver) DataProtectionImpactAssessment(ctx context.Context, obj *types.ProcessingActivity) (*types.DataProtectionImpactAssessment, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDataProtectionImpactAssessmentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	dpia, err := prb.DataProtectionImpactAssessments.GetByProcessingActivityID(ctx, scope, obj.ID)
@@ -261,11 +260,11 @@ func (r *processingActivityResolver) DataProtectionImpactAssessment(ctx context.
 
 // TransferImpactAssessment is the resolver for the transferImpactAssessment field.
 func (r *processingActivityResolver) TransferImpactAssessment(ctx context.Context, obj *types.ProcessingActivity) (*types.TransferImpactAssessment, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTransferImpactAssessmentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	tia, err := prb.TransferImpactAssessments.GetByProcessingActivityID(ctx, scope, obj.ID)
@@ -289,11 +288,11 @@ func (r *processingActivityResolver) Permission(ctx context.Context, obj *types.
 
 // TotalCount is the resolver for the totalCount field.
 func (r *processingActivityConnectionResolver) TotalCount(ctx context.Context, obj *types.ProcessingActivityConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionProcessingActivityList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionProcessingActivityList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/console/v1/resolver.go

@@ -360,5 +360,6 @@ func isValidPagerDutySubdomain(s string) bool {
 }
 
 func (r *Resolver) Permission(ctx context.Context, obj types.Node, action string) (bool, error) {
-	return r.authorize(ctx, obj.GetID(), action, authz.WithDryRun()) == nil, nil
+	_, err := r.authorize(ctx, obj.GetID(), action, authz.WithDryRun())
+	return err == nil, nil
 }

pkg/server/api/console/v1/rights_request_resolvers.go

@@ -21,11 +21,11 @@ import (
 
 // CreateRightsRequest is the resolver for the createRightsRequest field.
 func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types.CreateRightsRequestInput) (*types.CreateRightsRequestPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRightsRequestCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	req := probo.CreateRightsRequestRequest{
@@ -57,11 +57,11 @@ func (r *mutationResolver) CreateRightsRequest(ctx context.Context, input types.
 
 // UpdateRightsRequest is the resolver for the updateRightsRequest field.
 func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types.UpdateRightsRequestInput) (*types.UpdateRightsRequestPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRightsRequestUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRightsRequestUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateRightsRequestRequest{
@@ -93,15 +93,14 @@ func (r *mutationResolver) UpdateRightsRequest(ctx context.Context, input types.
 
 // DeleteRightsRequest is the resolver for the deleteRightsRequest field.
 func (r *mutationResolver) DeleteRightsRequest(ctx context.Context, input types.DeleteRightsRequestInput) (*types.DeleteRightsRequestPayload, error) {
-	if err := r.authorize(ctx, input.RightsRequestID, probo.ActionRightsRequestDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RightsRequestID, probo.ActionRightsRequestDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RightsRequestID)
 	prb := r.probo
 
-	err := prb.RightsRequests.Delete(ctx, scope, input.RightsRequestID)
-	if err != nil {
+	if err := prb.RightsRequests.Delete(ctx, scope, input.RightsRequestID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete rights request", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -113,11 +112,11 @@ func (r *mutationResolver) DeleteRightsRequest(ctx context.Context, input types.
 
 // Organization is the resolver for the organization field.
 func (r *rightsRequestResolver) Organization(ctx context.Context, obj *types.RightsRequest) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, iam.ActionOrganizationGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	rightsRequest, err := prb.RightsRequests.Get(ctx, scope, obj.ID)
@@ -147,11 +146,11 @@ func (r *rightsRequestResolver) Permission(ctx context.Context, obj *types.Right
 
 // TotalCount is the resolver for the totalCount field.
 func (r *rightsRequestConnectionResolver) TotalCount(ctx context.Context, obj *types.RightsRequestConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRightsRequestList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRightsRequestList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/console/v1/risk_assessment_resolvers.go

@@ -24,12 +24,11 @@ import (
 
 // CreateRiskAssessment is the resolver for the createRiskAssessment field.
 func (r *mutationResolver) CreateRiskAssessment(ctx context.Context, input types.CreateRiskAssessmentInput) (*types.CreateRiskAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskAssessmentCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskAssessmentCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
-
 	ra, err := r.riskManagement.Create(
 		ctx,
 		scope,
@@ -60,12 +59,11 @@ func (r *mutationResolver) CreateRiskAssessment(ctx context.Context, input types
 
 // UpdateRiskAssessment is the resolver for the updateRiskAssessment field.
 func (r *mutationResolver) UpdateRiskAssessment(ctx context.Context, input types.UpdateRiskAssessmentInput) (*types.UpdateRiskAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
-
 	ra, err := r.riskManagement.Update(
 		ctx,
 		scope,
@@ -90,11 +88,11 @@ func (r *mutationResolver) UpdateRiskAssessment(ctx context.Context, input types
 
 // DeleteRiskAssessment is the resolver for the deleteRiskAssessment field.
 func (r *mutationResolver) DeleteRiskAssessment(ctx context.Context, input types.DeleteRiskAssessmentInput) (*types.DeleteRiskAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentID)
 	if err := r.riskManagement.Delete(ctx, scope, input.RiskAssessmentID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -110,12 +108,11 @@ func (r *mutationResolver) DeleteRiskAssessment(ctx context.Context, input types
 
 // CreateRiskAssessmentScope is the resolver for the createRiskAssessmentScope field.
 func (r *mutationResolver) CreateRiskAssessmentScope(ctx context.Context, input types.CreateRiskAssessmentScopeInput) (*types.CreateRiskAssessmentScopePayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentScopeCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentID, probo.ActionRiskAssessmentScopeCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentID)
-
 	raScope, err := r.riskManagement.CreateScope(
 		ctx,
 		scope,
@@ -145,12 +142,11 @@ func (r *mutationResolver) CreateRiskAssessmentScope(ctx context.Context, input
 
 // UpdateRiskAssessmentScope is the resolver for the updateRiskAssessmentScope field.
 func (r *mutationResolver) UpdateRiskAssessmentScope(ctx context.Context, input types.UpdateRiskAssessmentScopeInput) (*types.UpdateRiskAssessmentScopePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScopeUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScopeUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
-
 	raScope, err := r.riskManagement.UpdateScope(
 		ctx,
 		scope,
@@ -174,11 +170,11 @@ func (r *mutationResolver) UpdateRiskAssessmentScope(ctx context.Context, input
 
 // DeleteRiskAssessmentScope is the resolver for the deleteRiskAssessmentScope field.
 func (r *mutationResolver) DeleteRiskAssessmentScope(ctx context.Context, input types.DeleteRiskAssessmentScopeInput) (*types.DeleteRiskAssessmentScopePayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID)
 	if err := r.riskManagement.DeleteScope(ctx, scope, input.RiskAssessmentScopeID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -194,12 +190,11 @@ func (r *mutationResolver) DeleteRiskAssessmentScope(ctx context.Context, input
 
 // CreateRiskAssessmentNode is the resolver for the createRiskAssessmentNode field.
 func (r *mutationResolver) CreateRiskAssessmentNode(ctx context.Context, input types.CreateRiskAssessmentNodeInput) (*types.CreateRiskAssessmentNodePayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentNodeCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentNodeCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID)
-
 	node, err := r.riskManagement.CreateNode(
 		ctx,
 		scope,
@@ -233,12 +228,11 @@ func (r *mutationResolver) CreateRiskAssessmentNode(ctx context.Context, input t
 
 // UpdateRiskAssessmentNode is the resolver for the updateRiskAssessmentNode field.
 func (r *mutationResolver) UpdateRiskAssessmentNode(ctx context.Context, input types.UpdateRiskAssessmentNodeInput) (*types.UpdateRiskAssessmentNodePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentNodeUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentNodeUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
-
 	node, err := r.riskManagement.UpdateNode(
 		ctx,
 		scope,
@@ -263,11 +257,11 @@ func (r *mutationResolver) UpdateRiskAssessmentNode(ctx context.Context, input t
 
 // DeleteRiskAssessmentNode is the resolver for the deleteRiskAssessmentNode field.
 func (r *mutationResolver) DeleteRiskAssessmentNode(ctx context.Context, input types.DeleteRiskAssessmentNodeInput) (*types.DeleteRiskAssessmentNodePayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentNodeID, probo.ActionRiskAssessmentNodeDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentNodeID, probo.ActionRiskAssessmentNodeDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentNodeID)
 	if err := r.riskManagement.DeleteNode(ctx, scope, input.RiskAssessmentNodeID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -283,12 +277,11 @@ func (r *mutationResolver) DeleteRiskAssessmentNode(ctx context.Context, input t
 
 // CreateRiskAssessmentProcess is the resolver for the createRiskAssessmentProcess field.
 func (r *mutationResolver) CreateRiskAssessmentProcess(ctx context.Context, input types.CreateRiskAssessmentProcessInput) (*types.CreateRiskAssessmentProcessPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentProcessCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentProcessCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID)
-
 	process, err := r.riskManagement.CreateProcess(
 		ctx,
 		scope,
@@ -323,12 +316,11 @@ func (r *mutationResolver) CreateRiskAssessmentProcess(ctx context.Context, inpu
 
 // UpdateRiskAssessmentProcess is the resolver for the updateRiskAssessmentProcess field.
 func (r *mutationResolver) UpdateRiskAssessmentProcess(ctx context.Context, input types.UpdateRiskAssessmentProcessInput) (*types.UpdateRiskAssessmentProcessPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentProcessUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentProcessUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
-
 	process, err := r.riskManagement.UpdateProcess(
 		ctx,
 		scope,
@@ -354,11 +346,11 @@ func (r *mutationResolver) UpdateRiskAssessmentProcess(ctx context.Context, inpu
 
 // DeleteRiskAssessmentProcess is the resolver for the deleteRiskAssessmentProcess field.
 func (r *mutationResolver) DeleteRiskAssessmentProcess(ctx context.Context, input types.DeleteRiskAssessmentProcessInput) (*types.DeleteRiskAssessmentProcessPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentProcessID, probo.ActionRiskAssessmentProcessDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentProcessID, probo.ActionRiskAssessmentProcessDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentProcessID)
 	if err := r.riskManagement.DeleteProcess(ctx, scope, input.RiskAssessmentProcessID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -374,12 +366,11 @@ func (r *mutationResolver) DeleteRiskAssessmentProcess(ctx context.Context, inpu
 
 // CreateRiskAssessmentThreat is the resolver for the createRiskAssessmentThreat field.
 func (r *mutationResolver) CreateRiskAssessmentThreat(ctx context.Context, input types.CreateRiskAssessmentThreatInput) (*types.CreateRiskAssessmentThreatPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentThreatCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentThreatCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID)
-
 	threat, err := r.riskManagement.CreateThreat(
 		ctx,
 		scope,
@@ -414,12 +405,11 @@ func (r *mutationResolver) CreateRiskAssessmentThreat(ctx context.Context, input
 
 // UpdateRiskAssessmentThreat is the resolver for the updateRiskAssessmentThreat field.
 func (r *mutationResolver) UpdateRiskAssessmentThreat(ctx context.Context, input types.UpdateRiskAssessmentThreatInput) (*types.UpdateRiskAssessmentThreatPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentThreatUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentThreatUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
-
 	threat, err := r.riskManagement.UpdateThreat(
 		ctx,
 		scope,
@@ -445,11 +435,11 @@ func (r *mutationResolver) UpdateRiskAssessmentThreat(ctx context.Context, input
 
 // DeleteRiskAssessmentThreat is the resolver for the deleteRiskAssessmentThreat field.
 func (r *mutationResolver) DeleteRiskAssessmentThreat(ctx context.Context, input types.DeleteRiskAssessmentThreatInput) (*types.DeleteRiskAssessmentThreatPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentThreatID, probo.ActionRiskAssessmentThreatDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentThreatID, probo.ActionRiskAssessmentThreatDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentThreatID)
 	if err := r.riskManagement.DeleteThreat(ctx, scope, input.RiskAssessmentThreatID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -465,12 +455,11 @@ func (r *mutationResolver) DeleteRiskAssessmentThreat(ctx context.Context, input
 
 // CreateRiskAssessmentScenario is the resolver for the createRiskAssessmentScenario field.
 func (r *mutationResolver) CreateRiskAssessmentScenario(ctx context.Context, input types.CreateRiskAssessmentScenarioInput) (*types.CreateRiskAssessmentScenarioPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScenarioCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScopeID, probo.ActionRiskAssessmentScenarioCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScopeID)
-
 	scenario, err := r.riskManagement.CreateScenario(
 		ctx,
 		scope,
@@ -504,12 +493,11 @@ func (r *mutationResolver) CreateRiskAssessmentScenario(ctx context.Context, inp
 
 // UpdateRiskAssessmentScenario is the resolver for the updateRiskAssessmentScenario field.
 func (r *mutationResolver) UpdateRiskAssessmentScenario(ctx context.Context, input types.UpdateRiskAssessmentScenarioInput) (*types.UpdateRiskAssessmentScenarioPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScenarioUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskAssessmentScenarioUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
-
 	scenario, err := r.riskManagement.UpdateScenario(
 		ctx,
 		scope,
@@ -534,11 +522,11 @@ func (r *mutationResolver) UpdateRiskAssessmentScenario(ctx context.Context, inp
 
 // DeleteRiskAssessmentScenario is the resolver for the deleteRiskAssessmentScenario field.
 func (r *mutationResolver) DeleteRiskAssessmentScenario(ctx context.Context, input types.DeleteRiskAssessmentScenarioInput) (*types.DeleteRiskAssessmentScenarioPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID)
 	if err := r.riskManagement.DeleteScenario(ctx, scope, input.RiskAssessmentScenarioID); err != nil {
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, gqlutils.NotFound(ctx, err)
@@ -554,11 +542,11 @@ func (r *mutationResolver) DeleteRiskAssessmentScenario(ctx context.Context, inp
 
 // LinkRiskAssessmentScenarioThreat is the resolver for the linkRiskAssessmentScenarioThreat field.
 func (r *mutationResolver) LinkRiskAssessmentScenarioThreat(ctx context.Context, input types.LinkRiskAssessmentScenarioThreatInput) (*types.LinkRiskAssessmentScenarioThreatPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatLink); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatLink)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID)
 	if err := r.riskManagement.LinkScenarioThreat(
 		ctx,
 		scope,
@@ -591,11 +579,11 @@ func (r *mutationResolver) LinkRiskAssessmentScenarioThreat(ctx context.Context,
 
 // UnlinkRiskAssessmentScenarioThreat is the resolver for the unlinkRiskAssessmentScenarioThreat field.
 func (r *mutationResolver) UnlinkRiskAssessmentScenarioThreat(ctx context.Context, input types.UnlinkRiskAssessmentScenarioThreatInput) (*types.UnlinkRiskAssessmentScenarioThreatPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatUnlink); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioThreatUnlink)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID)
 	if err := r.riskManagement.UnlinkScenarioThreat(
 		ctx,
 		scope,
@@ -624,11 +612,11 @@ func (r *mutationResolver) UnlinkRiskAssessmentScenarioThreat(ctx context.Contex
 
 // LinkRiskAssessmentScenarioRisk is the resolver for the linkRiskAssessmentScenarioRisk field.
 func (r *mutationResolver) LinkRiskAssessmentScenarioRisk(ctx context.Context, input types.LinkRiskAssessmentScenarioRiskInput) (*types.LinkRiskAssessmentScenarioRiskPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskLink); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskLink)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID)
 	if err := r.riskManagement.LinkScenarioRisk(
 		ctx,
 		scope,
@@ -669,11 +657,11 @@ func (r *mutationResolver) LinkRiskAssessmentScenarioRisk(ctx context.Context, i
 
 // UnlinkRiskAssessmentScenarioRisk is the resolver for the unlinkRiskAssessmentScenarioRisk field.
 func (r *mutationResolver) UnlinkRiskAssessmentScenarioRisk(ctx context.Context, input types.UnlinkRiskAssessmentScenarioRiskInput) (*types.UnlinkRiskAssessmentScenarioRiskPayload, error) {
-	if err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskUnlink); err != nil {
+	scope, err := r.authorize(ctx, input.RiskAssessmentScenarioID, probo.ActionRiskAssessmentScenarioRiskUnlink)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskAssessmentScenarioID)
 	if err := r.riskManagement.UnlinkScenarioRisk(
 		ctx,
 		scope,
@@ -705,7 +693,7 @@ func (r *mutationResolver) UnlinkRiskAssessmentScenarioRisk(ctx context.Context,
 
 // Organization is the resolver for the organization field.
 func (r *riskAssessmentResolver) Organization(ctx context.Context, obj *types.RiskAssessment) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -727,12 +715,11 @@ func (r *riskAssessmentResolver) Organization(ctx context.Context, obj *types.Ri
 
 // Scopes is the resolver for the scopes field.
 func (r *riskAssessmentResolver) Scopes(ctx context.Context, obj *types.RiskAssessment, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScopeOrderBy) (*types.RiskAssessmentScopeConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentScopeOrderField]{
 		Field:     coredata.RiskAssessmentScopeOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -759,12 +746,11 @@ func (r *riskAssessmentResolver) Permission(ctx context.Context, obj *types.Risk
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.riskManagement.CountForOrganizationID(ctx, scope, obj.ParentID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count risk assessments", log.Error(err))
@@ -776,12 +762,11 @@ func (r *riskAssessmentConnectionResolver) TotalCount(ctx context.Context, obj *
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskAssessmentNodeConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentNodeConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentNodeList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentNodeList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.riskManagement.CountNodesForScopeID(ctx, scope, obj.ParentID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count risk assessment nodes", log.Error(err))
@@ -793,12 +778,11 @@ func (r *riskAssessmentNodeConnectionResolver) TotalCount(ctx context.Context, o
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskAssessmentProcessConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentProcessConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentProcessList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentProcessList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.riskManagement.CountProcessesForScopeID(ctx, scope, obj.ParentID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count risk assessment processes", log.Error(err))
@@ -810,12 +794,11 @@ func (r *riskAssessmentProcessConnectionResolver) TotalCount(ctx context.Context
 
 // Scope is the resolver for the scope field.
 func (r *riskAssessmentScenarioResolver) Scope(ctx context.Context, obj *types.RiskAssessmentScenario) (*types.RiskAssessmentScope, error) {
-	if err := r.authorize(ctx, obj.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeGet); err != nil {
+	scope, err := r.authorize(ctx, obj.RiskAssessmentScopeID, probo.ActionRiskAssessmentScopeGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.RiskAssessmentScopeID)
-
 	raScope, err := r.riskManagement.GetScope(ctx, scope, obj.RiskAssessmentScopeID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot load risk assessment scope", log.Error(err))
@@ -827,12 +810,11 @@ func (r *riskAssessmentScenarioResolver) Scope(ctx context.Context, obj *types.R
 
 // Threats is the resolver for the threats field.
 func (r *riskAssessmentScenarioResolver) Threats(ctx context.Context, obj *types.RiskAssessmentScenario, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentThreatOrderBy) (*types.RiskAssessmentThreatConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentThreatOrderField]{
 		Field:     coredata.RiskAssessmentThreatOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -854,12 +836,11 @@ func (r *riskAssessmentScenarioResolver) Threats(ctx context.Context, obj *types
 
 // Risks is the resolver for the risks field.
 func (r *riskAssessmentScenarioResolver) Risks(ctx context.Context, obj *types.RiskAssessmentScenario, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskOrderBy) (*types.RiskConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskOrderField]{
 		Field:     coredata.RiskOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -881,12 +862,11 @@ func (r *riskAssessmentScenarioResolver) Risks(ctx context.Context, obj *types.R
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskAssessmentScenarioConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentScenarioConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScenarioList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScenarioList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	switch obj.Resolver.(type) {
 	case *riskAssessmentScopeResolver:
 		count, err := r.riskManagement.CountScenariosForScopeID(ctx, scope, obj.ParentID)
@@ -917,12 +897,11 @@ func (r *riskAssessmentScenarioConnectionResolver) TotalCount(ctx context.Contex
 
 // Nodes is the resolver for the nodes field.
 func (r *riskAssessmentScopeResolver) Nodes(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentNodeOrderBy) (*types.RiskAssessmentNodeConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentNodeList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentNodeList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentNodeOrderField]{
 		Field:     coredata.RiskAssessmentNodeOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -944,12 +923,11 @@ func (r *riskAssessmentScopeResolver) Nodes(ctx context.Context, obj *types.Risk
 
 // Processes is the resolver for the processes field.
 func (r *riskAssessmentScopeResolver) Processes(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentProcessOrderBy) (*types.RiskAssessmentProcessConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentProcessList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentProcessList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentProcessOrderField]{
 		Field:     coredata.RiskAssessmentProcessOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -971,12 +949,11 @@ func (r *riskAssessmentScopeResolver) Processes(ctx context.Context, obj *types.
 
 // Threats is the resolver for the threats field.
 func (r *riskAssessmentScopeResolver) Threats(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentThreatOrderBy) (*types.RiskAssessmentThreatConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentThreatList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentThreatOrderField]{
 		Field:     coredata.RiskAssessmentThreatOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -998,12 +975,11 @@ func (r *riskAssessmentScopeResolver) Threats(ctx context.Context, obj *types.Ri
 
 // Scenarios is the resolver for the scenarios field.
 func (r *riskAssessmentScopeResolver) Scenarios(ctx context.Context, obj *types.RiskAssessmentScope, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{
 		Field:     coredata.RiskAssessmentScenarioOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -1025,12 +1001,11 @@ func (r *riskAssessmentScopeResolver) Scenarios(ctx context.Context, obj *types.
 
 // MermaidChart is the resolver for the mermaidChart field.
 func (r *riskAssessmentScopeResolver) MermaidChart(ctx context.Context, obj *types.RiskAssessmentScope) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScopeGet)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	chart, err := r.riskManagement.BuildScopeMermaidChart(ctx, scope, obj.ID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot build risk assessment scope mermaid chart", log.Error(err))
@@ -1042,12 +1017,11 @@ func (r *riskAssessmentScopeResolver) MermaidChart(ctx context.Context, obj *typ
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskAssessmentScopeConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentScopeConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScopeList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentScopeList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	count, err := r.riskManagement.CountScopesForRiskAssessmentID(ctx, scope, obj.ParentID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot count risk assessment scopes", log.Error(err))
@@ -1059,12 +1033,11 @@ func (r *riskAssessmentScopeConnectionResolver) TotalCount(ctx context.Context,
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskAssessmentThreatConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskAssessmentThreatConnection) (*int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentThreatList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskAssessmentThreatList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
-
 	switch obj.Resolver.(type) {
 	case *riskAssessmentScenarioResolver:
 		count, err := r.riskManagement.CountThreatsForScenarioID(ctx, scope, obj.ParentID)

pkg/server/api/console/v1/risk_resolvers.go

@@ -24,11 +24,11 @@ import (
 
 // CreateRisk is the resolver for the createRisk field.
 func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRiskInput) (*types.CreateRiskPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	risk, err := prb.Risks.Create(
@@ -68,11 +68,11 @@ func (r *mutationResolver) CreateRisk(ctx context.Context, input types.CreateRis
 
 // UpdateRisk is the resolver for the updateRisk field.
 func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRiskInput) (*types.UpdateRiskPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionRiskUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionRiskUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	risk, err := prb.Risks.Update(
@@ -108,15 +108,14 @@ func (r *mutationResolver) UpdateRisk(ctx context.Context, input types.UpdateRis
 
 // DeleteRisk is the resolver for the deleteRisk field.
 func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRiskInput) (*types.DeleteRiskPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
-	err := prb.Risks.Delete(ctx, scope, input.RiskID)
-	if err != nil {
+	if err := prb.Risks.Delete(ctx, scope, input.RiskID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete risk", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -128,11 +127,11 @@ func (r *mutationResolver) DeleteRisk(ctx context.Context, input types.DeleteRis
 
 // CreateRiskMeasureMapping is the resolver for the createRiskMeasureMapping field.
 func (r *mutationResolver) CreateRiskMeasureMapping(ctx context.Context, input types.CreateRiskMeasureMappingInput) (*types.CreateRiskMeasureMappingPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
 	risk, measure, err := prb.Risks.CreateMeasureMapping(ctx, scope, input.RiskID, input.MeasureID)
@@ -149,11 +148,11 @@ func (r *mutationResolver) CreateRiskMeasureMapping(ctx context.Context, input t
 
 // DeleteRiskMeasureMapping is the resolver for the deleteRiskMeasureMapping field.
 func (r *mutationResolver) DeleteRiskMeasureMapping(ctx context.Context, input types.DeleteRiskMeasureMappingInput) (*types.DeleteRiskMeasureMappingPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskMeasureMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
 	risk, measure, err := prb.Risks.DeleteMeasureMapping(ctx, scope, input.RiskID, input.MeasureID)
@@ -170,11 +169,11 @@ func (r *mutationResolver) DeleteRiskMeasureMapping(ctx context.Context, input t
 
 // CreateRiskDocumentMapping is the resolver for the createRiskDocumentMapping field.
 func (r *mutationResolver) CreateRiskDocumentMapping(ctx context.Context, input types.CreateRiskDocumentMappingInput) (*types.CreateRiskDocumentMappingPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
 	risk, document, err := prb.Risks.CreateDocumentMapping(ctx, scope, input.RiskID, input.DocumentID)
@@ -191,11 +190,11 @@ func (r *mutationResolver) CreateRiskDocumentMapping(ctx context.Context, input
 
 // DeleteRiskDocumentMapping is the resolver for the deleteRiskDocumentMapping field.
 func (r *mutationResolver) DeleteRiskDocumentMapping(ctx context.Context, input types.DeleteRiskDocumentMappingInput) (*types.DeleteRiskDocumentMappingPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskDocumentMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
 	risk, document, err := prb.Risks.DeleteDocumentMapping(ctx, scope, input.RiskID, input.DocumentID)
@@ -212,11 +211,11 @@ func (r *mutationResolver) DeleteRiskDocumentMapping(ctx context.Context, input
 
 // CreateRiskObligationMapping is the resolver for the createRiskObligationMapping field.
 func (r *mutationResolver) CreateRiskObligationMapping(ctx context.Context, input types.CreateRiskObligationMappingInput) (*types.CreateRiskObligationMappingPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
 	risk, obligation, err := prb.Risks.CreateObligationMapping(ctx, scope, input.RiskID, input.ObligationID)
@@ -233,11 +232,11 @@ func (r *mutationResolver) CreateRiskObligationMapping(ctx context.Context, inpu
 
 // DeleteRiskObligationMapping is the resolver for the deleteRiskObligationMapping field.
 func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, input types.DeleteRiskObligationMappingInput) (*types.DeleteRiskObligationMappingPayload, error) {
-	if err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete); err != nil {
+	scope, err := r.authorize(ctx, input.RiskID, probo.ActionRiskObligationMappingDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.RiskID)
 	prb := r.probo
 
 	risk, obligation, err := prb.Risks.DeleteObligationMapping(ctx, scope, input.RiskID, input.ObligationID)
@@ -254,11 +253,11 @@ func (r *mutationResolver) DeleteRiskObligationMapping(ctx context.Context, inpu
 
 // PublishRiskList is the resolver for the publishRiskList field.
 func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.PublishRiskListInput) (*types.PublishRiskListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionRiskPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishRiskList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -284,7 +283,7 @@ func (r *mutationResolver) PublishRiskList(ctx context.Context, input types.Publ
 
 // Owner is the resolver for the owner field.
 func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -310,7 +309,7 @@ func (r *riskResolver) Owner(ctx context.Context, obj *types.Risk) (*types.Profi
 
 // Organization is the resolver for the organization field.
 func (r *riskResolver) Organization(ctx context.Context, obj *types.Risk) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -332,11 +331,11 @@ func (r *riskResolver) Organization(ctx context.Context, obj *types.Risk) (*type
 
 // Measures is the resolver for the measures field.
 func (r *riskResolver) Measures(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.MeasureOrderBy, filter *types.MeasureFilter) (*types.MeasureConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMeasureList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionMeasureList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.MeasureOrderField]{
@@ -368,11 +367,11 @@ func (r *riskResolver) Measures(ctx context.Context, obj *types.Risk, first *int
 
 // Documents is the resolver for the documents field.
 func (r *riskResolver) Documents(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy, filter *types.DocumentFilter) (*types.DocumentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
@@ -407,11 +406,11 @@ func (r *riskResolver) Documents(ctx context.Context, obj *types.Risk, first *in
 
 // Controls is the resolver for the controls field.
 func (r *riskResolver) Controls(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ControlOrderBy, filter *types.ControlFilter) (*types.ControlConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionControlList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionControlList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ControlOrderField]{
@@ -443,11 +442,11 @@ func (r *riskResolver) Controls(ctx context.Context, obj *types.Risk, first *int
 
 // Obligations is the resolver for the obligations field.
 func (r *riskResolver) Obligations(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ObligationOrderBy) (*types.ObligationConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionObligationList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionObligationList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ObligationOrderField]{
@@ -474,12 +473,11 @@ func (r *riskResolver) Obligations(ctx context.Context, obj *types.Risk, first *
 
 // Scenarios is the resolver for the scenarios field.
 func (r *riskResolver) Scenarios(ctx context.Context, obj *types.Risk, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.RiskAssessmentScenarioOrderBy) (*types.RiskAssessmentScenarioConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionRiskAssessmentScenarioList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
-
 	pageOrderBy := page.OrderBy[coredata.RiskAssessmentScenarioOrderField]{
 		Field:     coredata.RiskAssessmentScenarioOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
@@ -506,11 +504,11 @@ func (r *riskResolver) Permission(ctx context.Context, obj *types.Risk, action s
 
 // TotalCount is the resolver for the totalCount field.
 func (r *riskConnectionResolver) TotalCount(ctx context.Context, obj *types.RiskConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionRiskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionRiskList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/console/v1/task_resolvers.go

@@ -24,11 +24,11 @@ import (
 
 // CreateTask is the resolver for the createTask field.
 func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTaskInput) (*types.CreateTaskPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionTaskCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionTaskCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	task, err := prb.Tasks.Create(
@@ -65,11 +65,11 @@ func (r *mutationResolver) CreateTask(ctx context.Context, input types.CreateTas
 
 // UpdateTask is the resolver for the updateTask field.
 func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTaskInput) (*types.UpdateTaskPayload, error) {
-	if err := r.authorize(ctx, input.TaskID, probo.ActionTaskUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TaskID, probo.ActionTaskUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TaskID)
 	prb := r.probo
 
 	task, err := prb.Tasks.Update(
@@ -104,15 +104,14 @@ func (r *mutationResolver) UpdateTask(ctx context.Context, input types.UpdateTas
 
 // DeleteTask is the resolver for the deleteTask field.
 func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTaskInput) (*types.DeleteTaskPayload, error) {
-	if err := r.authorize(ctx, input.TaskID, probo.ActionTaskDelete); err != nil {
+	scope, err := r.authorize(ctx, input.TaskID, probo.ActionTaskDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TaskID)
 	prb := r.probo
 
-	err := prb.Tasks.Delete(ctx, scope, input.TaskID)
-	if err != nil {
+	if err := prb.Tasks.Delete(ctx, scope, input.TaskID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete task", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -124,7 +123,7 @@ func (r *mutationResolver) DeleteTask(ctx context.Context, input types.DeleteTas
 
 // AssignedTo is the resolver for the assignedTo field.
 func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -150,7 +149,7 @@ func (r *taskResolver) AssignedTo(ctx context.Context, obj *types.Task) (*types.
 
 // Organization is the resolver for the organization field.
 func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -172,7 +171,7 @@ func (r *taskResolver) Organization(ctx context.Context, obj *types.Task) (*type
 
 // Measure is the resolver for the measure field.
 func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Measure, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionMeasureGet); err != nil {
 		return nil, err
 	}
 
@@ -198,11 +197,11 @@ func (r *taskResolver) Measure(ctx context.Context, obj *types.Task) (*types.Mea
 
 // Evidences is the resolver for the evidences field.
 func (r *taskResolver) Evidences(ctx context.Context, obj *types.Task, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.EvidenceOrderBy) (*types.EvidenceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionEvidenceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.EvidenceOrderField]{
@@ -234,11 +233,11 @@ func (r *taskResolver) Permission(ctx context.Context, obj *types.Task, action s
 
 // TotalCount is the resolver for the totalCount field.
 func (r *taskConnectionResolver) TotalCount(ctx context.Context, obj *types.TaskConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionTaskList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTaskList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/console/v1/third_party_resolvers.go

@@ -27,11 +27,11 @@ import (
 
 // CreateThirdParty is the resolver for the createThirdParty field.
 func (r *mutationResolver) CreateThirdParty(ctx context.Context, input types.CreateThirdPartyInput) (*types.CreateThirdPartyPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	thirdParty, err := prb.ThirdParties.Create(
@@ -80,11 +80,11 @@ func (r *mutationResolver) CreateThirdParty(ctx context.Context, input types.Cre
 
 // UpdateThirdParty is the resolver for the updateThirdParty field.
 func (r *mutationResolver) UpdateThirdParty(ctx context.Context, input types.UpdateThirdPartyInput) (*types.UpdateThirdPartyPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	thirdParty, err := prb.ThirdParties.Update(
@@ -130,15 +130,14 @@ func (r *mutationResolver) UpdateThirdParty(ctx context.Context, input types.Upd
 
 // DeleteThirdParty is the resolver for the deleteThirdParty field.
 func (r *mutationResolver) DeleteThirdParty(ctx context.Context, input types.DeleteThirdPartyInput) (*types.DeleteThirdPartyPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
-	err := prb.ThirdParties.Delete(ctx, scope, input.ThirdPartyID)
-	if err != nil {
+	if err := prb.ThirdParties.Delete(ctx, scope, input.ThirdPartyID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete thirdParty", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -150,11 +149,11 @@ func (r *mutationResolver) DeleteThirdParty(ctx context.Context, input types.Del
 
 // CreateThirdPartyContact is the resolver for the createThirdPartyContact field.
 func (r *mutationResolver) CreateThirdPartyContact(ctx context.Context, input types.CreateThirdPartyContactInput) (*types.CreateThirdPartyContactPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	req := probo.CreateThirdPartyContactRequest{
@@ -183,11 +182,11 @@ func (r *mutationResolver) CreateThirdPartyContact(ctx context.Context, input ty
 
 // UpdateThirdPartyContact is the resolver for the updateThirdPartyContact field.
 func (r *mutationResolver) UpdateThirdPartyContact(ctx context.Context, input types.UpdateThirdPartyContactInput) (*types.UpdateThirdPartyContactPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateThirdPartyContactRequest{
@@ -216,15 +215,14 @@ func (r *mutationResolver) UpdateThirdPartyContact(ctx context.Context, input ty
 
 // DeleteThirdPartyContact is the resolver for the deleteThirdPartyContact field.
 func (r *mutationResolver) DeleteThirdPartyContact(ctx context.Context, input types.DeleteThirdPartyContactInput) (*types.DeleteThirdPartyContactPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyContactID, probo.ActionThirdPartyContactDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyContactID, probo.ActionThirdPartyContactDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyContactID)
 	prb := r.probo
 
-	err := prb.ThirdPartyContacts.Delete(ctx, scope, input.ThirdPartyContactID)
-	if err != nil {
+	if err := prb.ThirdPartyContacts.Delete(ctx, scope, input.ThirdPartyContactID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete thirdParty contact", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -236,11 +234,11 @@ func (r *mutationResolver) DeleteThirdPartyContact(ctx context.Context, input ty
 
 // CreateThirdPartyService is the resolver for the createThirdPartyService field.
 func (r *mutationResolver) CreateThirdPartyService(ctx context.Context, input types.CreateThirdPartyServiceInput) (*types.CreateThirdPartyServicePayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	req := probo.CreateThirdPartyServiceRequest{
@@ -267,11 +265,11 @@ func (r *mutationResolver) CreateThirdPartyService(ctx context.Context, input ty
 
 // UpdateThirdPartyService is the resolver for the updateThirdPartyService field.
 func (r *mutationResolver) UpdateThirdPartyService(ctx context.Context, input types.UpdateThirdPartyServiceInput) (*types.UpdateThirdPartyServicePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := probo.UpdateThirdPartyServiceRequest{
@@ -298,15 +296,14 @@ func (r *mutationResolver) UpdateThirdPartyService(ctx context.Context, input ty
 
 // DeleteThirdPartyService is the resolver for the deleteThirdPartyService field.
 func (r *mutationResolver) DeleteThirdPartyService(ctx context.Context, input types.DeleteThirdPartyServiceInput) (*types.DeleteThirdPartyServicePayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyServiceID, probo.ActionThirdPartyServiceDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyServiceID, probo.ActionThirdPartyServiceDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyServiceID)
 	prb := r.probo
 
-	err := prb.ThirdPartyServices.Delete(ctx, scope, input.ThirdPartyServiceID)
-	if err != nil {
+	if err := prb.ThirdPartyServices.Delete(ctx, scope, input.ThirdPartyServiceID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete thirdParty service", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -318,11 +315,11 @@ func (r *mutationResolver) DeleteThirdPartyService(ctx context.Context, input ty
 
 // UploadThirdPartyComplianceReport is the resolver for the uploadThirdPartyComplianceReport field.
 func (r *mutationResolver) UploadThirdPartyComplianceReport(ctx context.Context, input types.UploadThirdPartyComplianceReportInput) (*types.UploadThirdPartyComplianceReportPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyComplianceReportUpload); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyComplianceReportUpload)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	thirdPartyComplianceReport, err := prb.ThirdPartyComplianceReports.Upload(
@@ -352,15 +349,14 @@ func (r *mutationResolver) UploadThirdPartyComplianceReport(ctx context.Context,
 
 // DeleteThirdPartyComplianceReport is the resolver for the deleteThirdPartyComplianceReport field.
 func (r *mutationResolver) DeleteThirdPartyComplianceReport(ctx context.Context, input types.DeleteThirdPartyComplianceReportInput) (*types.DeleteThirdPartyComplianceReportPayload, error) {
-	if err := r.authorize(ctx, input.ReportID, probo.ActionThirdPartyComplianceReportDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ReportID, probo.ActionThirdPartyComplianceReportDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ReportID)
 	prb := r.probo
 
-	err := prb.ThirdPartyComplianceReports.Delete(ctx, scope, input.ReportID)
-	if err != nil {
+	if err := prb.ThirdPartyComplianceReports.Delete(ctx, scope, input.ReportID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete thirdParty compliance report", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -372,11 +368,11 @@ func (r *mutationResolver) DeleteThirdPartyComplianceReport(ctx context.Context,
 
 // UploadThirdPartyBusinessAssociateAgreement is the resolver for the uploadThirdPartyBusinessAssociateAgreement field.
 func (r *mutationResolver) UploadThirdPartyBusinessAssociateAgreement(ctx context.Context, input types.UploadThirdPartyBusinessAssociateAgreementInput) (*types.UploadThirdPartyBusinessAssociateAgreementPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpload); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpload)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	thirdPartyBusinessAssociateAgreement, file, err := prb.ThirdPartyBusinessAssociateAgreements.Upload(
@@ -406,11 +402,11 @@ func (r *mutationResolver) UploadThirdPartyBusinessAssociateAgreement(ctx contex
 
 // UpdateThirdPartyBusinessAssociateAgreement is the resolver for the updateThirdPartyBusinessAssociateAgreement field.
 func (r *mutationResolver) UpdateThirdPartyBusinessAssociateAgreement(ctx context.Context, input types.UpdateThirdPartyBusinessAssociateAgreementInput) (*types.UpdateThirdPartyBusinessAssociateAgreementPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	thirdPartyBusinessAssociateAgreement, file, err := prb.ThirdPartyBusinessAssociateAgreements.Update(
@@ -438,15 +434,14 @@ func (r *mutationResolver) UpdateThirdPartyBusinessAssociateAgreement(ctx contex
 
 // DeleteThirdPartyBusinessAssociateAgreement is the resolver for the deleteThirdPartyBusinessAssociateAgreement field.
 func (r *mutationResolver) DeleteThirdPartyBusinessAssociateAgreement(ctx context.Context, input types.DeleteThirdPartyBusinessAssociateAgreementInput) (*types.DeleteThirdPartyBusinessAssociateAgreementPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyBusinessAssociateAgreementDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
-	err := prb.ThirdPartyBusinessAssociateAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID)
-	if err != nil {
+	if err := prb.ThirdPartyBusinessAssociateAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete thirdParty business associate agreement", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -458,11 +453,11 @@ func (r *mutationResolver) DeleteThirdPartyBusinessAssociateAgreement(ctx contex
 
 // UploadThirdPartyDataPrivacyAgreement is the resolver for the uploadThirdPartyDataPrivacyAgreement field.
 func (r *mutationResolver) UploadThirdPartyDataPrivacyAgreement(ctx context.Context, input types.UploadThirdPartyDataPrivacyAgreementInput) (*types.UploadThirdPartyDataPrivacyAgreementPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpload); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpload)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	thirdPartyDataPrivacyAgreement, file, err := prb.ThirdPartyDataPrivacyAgreements.Upload(
@@ -492,11 +487,11 @@ func (r *mutationResolver) UploadThirdPartyDataPrivacyAgreement(ctx context.Cont
 
 // UpdateThirdPartyDataPrivacyAgreement is the resolver for the updateThirdPartyDataPrivacyAgreement field.
 func (r *mutationResolver) UpdateThirdPartyDataPrivacyAgreement(ctx context.Context, input types.UpdateThirdPartyDataPrivacyAgreementInput) (*types.UpdateThirdPartyDataPrivacyAgreementPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	thirdPartyDataPrivacyAgreement, file, err := prb.ThirdPartyDataPrivacyAgreements.Update(
@@ -524,15 +519,14 @@ func (r *mutationResolver) UpdateThirdPartyDataPrivacyAgreement(ctx context.Cont
 
 // DeleteThirdPartyDataPrivacyAgreement is the resolver for the deleteThirdPartyDataPrivacyAgreement field.
 func (r *mutationResolver) DeleteThirdPartyDataPrivacyAgreement(ctx context.Context, input types.DeleteThirdPartyDataPrivacyAgreementInput) (*types.DeleteThirdPartyDataPrivacyAgreementPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyDataPrivacyAgreementDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
-	err := prb.ThirdPartyDataPrivacyAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID)
-	if err != nil {
+	if err := prb.ThirdPartyDataPrivacyAgreements.DeleteByThirdPartyID(ctx, scope, input.ThirdPartyID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete thirdParty data privacy agreement", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -544,11 +538,11 @@ func (r *mutationResolver) DeleteThirdPartyDataPrivacyAgreement(ctx context.Cont
 
 // CreateThirdPartyRiskAssessment is the resolver for the createThirdPartyRiskAssessment field.
 func (r *mutationResolver) CreateThirdPartyRiskAssessment(ctx context.Context, input types.CreateThirdPartyRiskAssessmentInput) (*types.CreateThirdPartyRiskAssessmentPayload, error) {
-	if err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate); err != nil {
+	scope, err := r.authorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ThirdPartyID)
 	prb := r.probo
 
 	thirdPartyRiskAssessment, err := prb.ThirdParties.CreateRiskAssessment(
@@ -578,11 +572,11 @@ func (r *mutationResolver) CreateThirdPartyRiskAssessment(ctx context.Context, i
 
 // AssessThirdParty is the resolver for the assessThirdParty field.
 func (r *mutationResolver) AssessThirdParty(ctx context.Context, input types.AssessThirdPartyInput) (*types.AssessThirdPartyPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionThirdPartyAssess); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionThirdPartyAssess)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	result, err := prb.ThirdParties.Assess(
@@ -612,11 +606,11 @@ func (r *mutationResolver) AssessThirdParty(ctx context.Context, input types.Ass
 
 // PublishThirdPartyList is the resolver for the publishThirdPartyList field.
 func (r *mutationResolver) PublishThirdPartyList(ctx context.Context, input types.PublishThirdPartyListInput) (*types.PublishThirdPartyListPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	document, documentVersion, err := prb.GeneratedDocuments.PublishThirdPartyList(ctx, scope, input.OrganizationID, input.ApproverIds, input.Minor)
@@ -642,7 +636,7 @@ func (r *mutationResolver) PublishThirdPartyList(ctx context.Context, input type
 
 // Organization is the resolver for the organization field.
 func (r *thirdPartyResolver) Organization(ctx context.Context, obj *types.ThirdParty) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -664,11 +658,11 @@ func (r *thirdPartyResolver) Organization(ctx context.Context, obj *types.ThirdP
 
 // ComplianceReports is the resolver for the complianceReports field.
 func (r *thirdPartyResolver) ComplianceReports(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyComplianceReportOrderBy) (*types.ThirdPartyComplianceReportConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyComplianceReportList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyComplianceReportList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyComplianceReportOrderField]{
@@ -695,11 +689,11 @@ func (r *thirdPartyResolver) ComplianceReports(ctx context.Context, obj *types.T
 
 // BusinessAssociateAgreement is the resolver for the businessAssociateAgreement field.
 func (r *thirdPartyResolver) BusinessAssociateAgreement(ctx context.Context, obj *types.ThirdParty) (*types.ThirdPartyBusinessAssociateAgreement, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyBusinessAssociateAgreementGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyBusinessAssociateAgreementGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	thirdPartyBusinessAssociateAgreement, file, err := prb.ThirdPartyBusinessAssociateAgreements.GetByThirdPartyID(ctx, scope, obj.ID)
@@ -718,11 +712,11 @@ func (r *thirdPartyResolver) BusinessAssociateAgreement(ctx context.Context, obj
 
 // DataPrivacyAgreement is the resolver for the dataPrivacyAgreement field.
 func (r *thirdPartyResolver) DataPrivacyAgreement(ctx context.Context, obj *types.ThirdParty) (*types.ThirdPartyDataPrivacyAgreement, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyDataPrivacyAgreementGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyDataPrivacyAgreementGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	thirdPartyDataPrivacyAgreement, file, err := prb.ThirdPartyDataPrivacyAgreements.GetByThirdPartyID(ctx, scope, obj.ID)
@@ -741,11 +735,11 @@ func (r *thirdPartyResolver) DataPrivacyAgreement(ctx context.Context, obj *type
 
 // Contacts is the resolver for the contacts field.
 func (r *thirdPartyResolver) Contacts(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyContactOrderBy) (*types.ThirdPartyContactConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyContactList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyContactList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyContactOrderField]{
@@ -772,11 +766,11 @@ func (r *thirdPartyResolver) Contacts(ctx context.Context, obj *types.ThirdParty
 
 // Services is the resolver for the services field.
 func (r *thirdPartyResolver) Services(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyServiceOrderBy) (*types.ThirdPartyServiceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyServiceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyServiceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyServiceOrderField]{
@@ -803,11 +797,11 @@ func (r *thirdPartyResolver) Services(ctx context.Context, obj *types.ThirdParty
 
 // RiskAssessments is the resolver for the riskAssessments field.
 func (r *thirdPartyResolver) RiskAssessments(ctx context.Context, obj *types.ThirdParty, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyRiskAssessmentOrder) (*types.ThirdPartyRiskAssessmentConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyRiskAssessmentList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyRiskAssessmentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ThirdPartyRiskAssessmentOrderField]{
@@ -834,7 +828,7 @@ func (r *thirdPartyResolver) RiskAssessments(ctx context.Context, obj *types.Thi
 
 // BusinessOwner is the resolver for the businessOwner field.
 func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -860,7 +854,7 @@ func (r *thirdPartyResolver) BusinessOwner(ctx context.Context, obj *types.Third
 
 // SecurityOwner is the resolver for the securityOwner field.
 func (r *thirdPartyResolver) SecurityOwner(ctx context.Context, obj *types.ThirdParty) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -891,11 +885,11 @@ func (r *thirdPartyResolver) Permission(ctx context.Context, obj *types.ThirdPar
 
 // ThirdParty is the resolver for the thirdParty field.
 func (r *thirdPartyBusinessAssociateAgreementResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyBusinessAssociateAgreement) (*types.ThirdParty, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	thirdParty, err := prb.ThirdParties.Get(ctx, scope, obj.ID)
@@ -912,11 +906,11 @@ func (r *thirdPartyBusinessAssociateAgreementResolver) ThirdParty(ctx context.Co
 
 // FileURL is the resolver for the fileUrl field.
 func (r *thirdPartyBusinessAssociateAgreementResolver) FileURL(ctx context.Context, obj *types.ThirdPartyBusinessAssociateAgreement) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	fileURL, err := prb.ThirdPartyBusinessAssociateAgreements.GenerateFileURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -935,11 +929,11 @@ func (r *thirdPartyBusinessAssociateAgreementResolver) Permission(ctx context.Co
 
 // ThirdParty is the resolver for the thirdParty field.
 func (r *thirdPartyComplianceReportResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyComplianceReport) (*types.ThirdParty, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	thirdParty, err := prb.ThirdParties.Get(ctx, scope, obj.ID)
@@ -958,11 +952,11 @@ func (r *thirdPartyComplianceReportResolver) ThirdParty(ctx context.Context, obj
 
 // File is the resolver for the file field.
 func (r *thirdPartyComplianceReportResolver) File(ctx context.Context, obj *types.ThirdPartyComplianceReport) (*types.File, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFileGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFileGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	evidence, err := prb.ThirdPartyComplianceReports.Get(ctx, scope, obj.ID)
@@ -996,11 +990,11 @@ func (r *thirdPartyComplianceReportResolver) Permission(ctx context.Context, obj
 
 // TotalCount is the resolver for the totalCount field.
 func (r *thirdPartyConnectionResolver) TotalCount(ctx context.Context, obj *types.ThirdPartyConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionThirdPartyList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionThirdPartyList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {
@@ -1037,11 +1031,11 @@ func (r *thirdPartyConnectionResolver) TotalCount(ctx context.Context, obj *type
 
 // ThirdParty is the resolver for the thirdParty field.
 func (r *thirdPartyContactResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyContact) (*types.ThirdParty, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	// Get the thirdParty contact to access the ThirdPartyID
@@ -1072,11 +1066,11 @@ func (r *thirdPartyContactResolver) Permission(ctx context.Context, obj *types.T
 
 // ThirdParty is the resolver for the thirdParty field.
 func (r *thirdPartyDataPrivacyAgreementResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyDataPrivacyAgreement) (*types.ThirdParty, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	thirdParty, err := prb.ThirdParties.Get(ctx, scope, obj.ID)
@@ -1095,11 +1089,11 @@ func (r *thirdPartyDataPrivacyAgreementResolver) ThirdParty(ctx context.Context,
 
 // FileURL is the resolver for the fileUrl field.
 func (r *thirdPartyDataPrivacyAgreementResolver) FileURL(ctx context.Context, obj *types.ThirdPartyDataPrivacyAgreement) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionFileDownloadUrl)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	fileURL, err := prb.ThirdPartyDataPrivacyAgreements.GenerateFileURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -1118,11 +1112,11 @@ func (r *thirdPartyDataPrivacyAgreementResolver) Permission(ctx context.Context,
 
 // ThirdParty is the resolver for the thirdParty field.
 func (r *thirdPartyRiskAssessmentResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyRiskAssessment) (*types.ThirdParty, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	thirdParty, err := prb.ThirdParties.GetByRiskAssessmentID(ctx, scope, obj.ID)
@@ -1146,7 +1140,7 @@ func (r *thirdPartyRiskAssessmentResolver) Permission(ctx context.Context, obj *
 
 // ThirdParty is the resolver for the thirdParty field.
 func (r *thirdPartyServiceResolver) ThirdParty(ctx context.Context, obj *types.ThirdPartyService) (*types.ThirdParty, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyGet); err != nil {
 		return nil, err
 	}
 

pkg/server/api/console/v1/trust_center_resolvers.go

@@ -31,7 +31,7 @@ func (r *complianceExternalURLResolver) Permission(ctx context.Context, obj *typ
 
 // Framework is the resolver for the framework field.
 func (r *complianceFrameworkResolver) Framework(ctx context.Context, obj *types.ComplianceFramework) (*types.Framework, error) {
-	if err := r.authorize(ctx, obj.FrameworkID, probo.ActionFrameworkGet); err != nil {
+	if _, err := r.authorize(ctx, obj.FrameworkID, probo.ActionFrameworkGet); err != nil {
 		return nil, err
 	}
 
@@ -58,11 +58,11 @@ func (r *customDomainResolver) Permission(ctx context.Context, obj *types.Custom
 
 // UpdateTrustCenter is the resolver for the updateTrustCenter field.
 func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.UpdateTrustCenterInput) (*types.UpdateTrustCenterPayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	trustCenter, file, err := prb.TrustCenters.Update(
@@ -90,11 +90,11 @@ func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.Up
 
 // UploadTrustCenterNda is the resolver for the uploadTrustCenterNDA field.
 func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types.UploadTrustCenterNDAInput) (*types.UploadTrustCenterNDAPayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementUpload); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementUpload)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	trustCenter, file, err := prb.TrustCenters.UploadNDA(
@@ -122,11 +122,11 @@ func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types
 
 // DeleteTrustCenterNda is the resolver for the deleteTrustCenterNDA field.
 func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types.DeleteTrustCenterNDAInput) (*types.DeleteTrustCenterNDAPayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementDelete); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterNonDisclosureAgreementDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	trustCenter, file, err := prb.TrustCenters.DeleteNDA(ctx, scope, input.TrustCenterID)
@@ -142,11 +142,11 @@ func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types
 
 // UpdateTrustCenterBrand is the resolver for the updateTrustCenterBrand field.
 func (r *mutationResolver) UpdateTrustCenterBrand(ctx context.Context, input types.UpdateTrustCenterBrandInput) (*types.UpdateTrustCenterBrandPayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	req := &probo.UpdateTrustCenterBrandRequest{
@@ -205,11 +205,11 @@ func (r *mutationResolver) UpdateTrustCenterBrand(ctx context.Context, input typ
 
 // UpdateTrustCenterAccess is the resolver for the updateTrustCenterAccess field.
 func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input types.UpdateTrustCenterAccessInput) (*types.UpdateTrustCenterAccessPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	var (
@@ -265,15 +265,14 @@ func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input ty
 
 // DeleteTrustCenterAccess is the resolver for the deleteTrustCenterAccess field.
 func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input types.DeleteTrustCenterAccessInput) (*types.DeleteTrustCenterAccessPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterAccessDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
-	err := prb.TrustCenterAccesses.Delete(ctx, scope, input.ID)
-	if err != nil {
+	if err := prb.TrustCenterAccesses.Delete(ctx, scope, input.ID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete trust center access", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -285,11 +284,11 @@ func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input ty
 
 // CreateTrustCenterReference is the resolver for the createTrustCenterReference field.
 func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input types.CreateTrustCenterReferenceInput) (*types.CreateTrustCenterReferencePayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceCreate); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionTrustCenterReferenceCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	reference, err := prb.TrustCenterReferences.Create(
@@ -324,11 +323,11 @@ func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input
 
 // UpdateTrustCenterReference is the resolver for the updateTrustCenterReference field.
 func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input types.UpdateTrustCenterReferenceInput) (*types.UpdateTrustCenterReferencePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	req := &probo.UpdateTrustCenterReferenceRequest{
@@ -366,15 +365,14 @@ func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input
 
 // DeleteTrustCenterReference is the resolver for the deleteTrustCenterReference field.
 func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input types.DeleteTrustCenterReferenceInput) (*types.DeleteTrustCenterReferencePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterReferenceDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
-	err := prb.TrustCenterReferences.Delete(ctx, scope, input.ID)
-	if err != nil {
+	if err := prb.TrustCenterReferences.Delete(ctx, scope, input.ID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete trust center reference", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -386,11 +384,11 @@ func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input
 
 // CreateComplianceFramework is the resolver for the createComplianceFramework field.
 func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input types.CreateComplianceFrameworkInput) (*types.CreateComplianceFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceFrameworkCreate); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceFrameworkCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	cf, err := prb.ComplianceFrameworks.Create(
@@ -417,11 +415,11 @@ func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input
 
 // UpdateComplianceFramework is the resolver for the updateComplianceFramework field.
 func (r *mutationResolver) UpdateComplianceFramework(ctx context.Context, input types.UpdateComplianceFrameworkInput) (*types.UpdateComplianceFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkUpdateRank); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkUpdateRank)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	cf, err := prb.ComplianceFrameworks.Update(ctx, scope, &probo.UpdateComplianceFrameworkRequest{
@@ -445,20 +443,19 @@ func (r *mutationResolver) UpdateComplianceFramework(ctx context.Context, input
 
 // DeleteComplianceFramework is the resolver for the deleteComplianceFramework field.
 func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input types.DeleteComplianceFrameworkInput) (*types.DeleteComplianceFrameworkPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceFrameworkDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
-	err := prb.ComplianceFrameworks.Delete(
+	if err := prb.ComplianceFrameworks.Delete(
 		ctx, scope,
 		&probo.DeleteComplianceFrameworkRequest{
 			ID: input.ID,
 		},
-	)
-	if err != nil {
+	); err != nil {
 		if validationErrors, ok := errors.AsType[validator.ValidationErrors](err); ok {
 			return nil, gqlutils.InvalidValidationErrors(ctx, validationErrors)
 		}
@@ -475,11 +472,11 @@ func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input
 
 // CreateComplianceExternalURL is the resolver for the createComplianceExternalURL field.
 func (r *mutationResolver) CreateComplianceExternalURL(ctx context.Context, input types.CreateComplianceExternalURLInput) (*types.CreateComplianceExternalURLPayload, error) {
-	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate); err != nil {
+	scope, err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.TrustCenterID)
 	prb := r.probo
 
 	item, err := prb.ComplianceExternalURLs.Create(
@@ -507,11 +504,11 @@ func (r *mutationResolver) CreateComplianceExternalURL(ctx context.Context, inpu
 
 // UpdateComplianceExternalURL is the resolver for the updateComplianceExternalURL field.
 func (r *mutationResolver) UpdateComplianceExternalURL(ctx context.Context, input types.UpdateComplianceExternalURLInput) (*types.UpdateComplianceExternalURLPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	item, err := prb.ComplianceExternalURLs.Update(ctx, scope, &probo.UpdateComplianceExternalURLRequest{
@@ -537,11 +534,11 @@ func (r *mutationResolver) UpdateComplianceExternalURL(ctx context.Context, inpu
 
 // DeleteComplianceExternalURL is the resolver for the deleteComplianceExternalURL field.
 func (r *mutationResolver) DeleteComplianceExternalURL(ctx context.Context, input types.DeleteComplianceExternalURLInput) (*types.DeleteComplianceExternalURLPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	if err := prb.ComplianceExternalURLs.Delete(ctx, scope, &probo.DeleteComplianceExternalURLRequest{ID: input.ID}); err != nil {
@@ -561,11 +558,11 @@ func (r *mutationResolver) DeleteComplianceExternalURL(ctx context.Context, inpu
 
 // CreateTrustCenterFile is the resolver for the createTrustCenterFile field.
 func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input types.CreateTrustCenterFileInput) (*types.CreateTrustCenterFilePayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	file, err := prb.TrustCenterFiles.Create(
@@ -600,11 +597,11 @@ func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input type
 
 // UpdateTrustCenterFile is the resolver for the updateTrustCenterFile field.
 func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input types.UpdateTrustCenterFileInput) (*types.UpdateTrustCenterFilePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	file, err := prb.TrustCenterFiles.Update(
@@ -633,11 +630,11 @@ func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input type
 
 // GetTrustCenterFile is the resolver for the getTrustCenterFile field.
 func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.GetTrustCenterFileInput) (*types.GetTrustCenterFilePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileGet); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	file, err := prb.TrustCenterFiles.Get(ctx, scope, input.ID)
@@ -653,15 +650,14 @@ func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.G
 
 // DeleteTrustCenterFile is the resolver for the deleteTrustCenterFile field.
 func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input types.DeleteTrustCenterFileInput) (*types.DeleteTrustCenterFilePayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileDelete); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionTrustCenterFileDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
-	err := prb.TrustCenterFiles.Delete(ctx, scope, input.ID)
-	if err != nil {
+	if err := prb.TrustCenterFiles.Delete(ctx, scope, input.ID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete trust center file", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -673,11 +669,11 @@ func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input type
 
 // CreateCustomDomain is the resolver for the createCustomDomain field.
 func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.CreateCustomDomainInput) (*types.CreateCustomDomainPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	domain, err := prb.CustomDomains.CreateCustomDomain(
@@ -704,11 +700,11 @@ func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.C
 
 // DeleteCustomDomain is the resolver for the deleteCustomDomain field.
 func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.DeleteCustomDomainInput) (*types.DeleteCustomDomainPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainDelete); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionCustomDomainDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	// TODO Drop this wierd logic
@@ -737,11 +733,11 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D
 
 // LogoFileURL is the resolver for the logoFileUrl field.
 func (r *trustCenterResolver) LogoFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	logoURL, err := prb.TrustCenters.GenerateLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -755,11 +751,11 @@ func (r *trustCenterResolver) LogoFileURL(ctx context.Context, obj *types.TrustC
 
 // DarkLogoFileURL is the resolver for the darkLogoFileUrl field.
 func (r *trustCenterResolver) DarkLogoFileURL(ctx context.Context, obj *types.TrustCenter) (*string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	logoURL, err := prb.TrustCenters.GenerateDarkLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -797,11 +793,11 @@ func (r *trustCenterResolver) NdaFileURL(ctx context.Context, obj *types.TrustCe
 
 // Organization is the resolver for the organization field.
 func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.TrustCenter) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	trustCenter, err := prb.TrustCenters.Get(ctx, scope, obj.ID)
@@ -826,11 +822,11 @@ func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.Trust
 
 // Accesses is the resolver for the accesses field.
 func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterAccessOrderField]) (*types.TrustCenterAccessConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TrustCenterAccessOrderField]{
@@ -857,11 +853,11 @@ func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCent
 
 // References is the resolver for the references field.
 func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterReferenceOrderField]) (*types.TrustCenterReferenceConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TrustCenterReferenceOrderField]{
@@ -888,11 +884,11 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe
 
 // ComplianceFrameworks is the resolver for the complianceFrameworks field.
 func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceFrameworkOrderField]) (*types.ComplianceFrameworkConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionComplianceFrameworkList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionComplianceFrameworkList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ComplianceFrameworkOrderField]{
@@ -919,11 +915,11 @@ func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *typ
 
 // ExternalUrls is the resolver for the externalUrls field.
 func (r *trustCenterResolver) ExternalUrls(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceExternalURLOrderField]) (*types.ComplianceExternalURLConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionComplianceExternalURLList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionComplianceExternalURLList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.ComplianceExternalURLOrderField]{
@@ -950,7 +946,8 @@ func (r *trustCenterResolver) ExternalUrls(ctx context.Context, obj *types.Trust
 
 // MailingList is the resolver for the mailingList field.
 func (r *trustCenterResolver) MailingList(ctx context.Context, obj *types.TrustCenter) (*types.MailingList, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionMailingListSubscriberList)
+	if err != nil {
 		return nil, err
 	}
 
@@ -958,7 +955,6 @@ func (r *trustCenterResolver) MailingList(ctx context.Context, obj *types.TrustC
 		return obj.MailingList, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	ml, err := prb.TrustCenters.GetMailingList(ctx, scope, obj.ID)
@@ -981,11 +977,11 @@ func (r *trustCenterResolver) Permission(ctx context.Context, obj *types.TrustCe
 
 // NdaSignature is the resolver for the ndaSignature field.
 func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types.TrustCenterAccess) (*types.ElectronicSignature, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	access, err := prb.TrustCenterAccesses.Get(ctx, scope, obj.ID)
@@ -1007,11 +1003,11 @@ func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types
 
 // PendingRequestCount is the resolver for the pendingRequestCount field.
 func (r *trustCenterAccessResolver) PendingRequestCount(ctx context.Context, obj *types.TrustCenterAccess) (int, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	count, err := prb.TrustCenterAccesses.CountPendingRequestDocumentAccesses(ctx, scope, obj.ID)
@@ -1025,11 +1021,11 @@ func (r *trustCenterAccessResolver) PendingRequestCount(ctx context.Context, obj
 
 // ActiveCount is the resolver for the activeCount field.
 func (r *trustCenterAccessResolver) ActiveCount(ctx context.Context, obj *types.TrustCenterAccess) (int, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	count, err := prb.TrustCenterAccesses.CountActiveDocumentAccesses(ctx, scope, obj.ID)
@@ -1043,7 +1039,7 @@ func (r *trustCenterAccessResolver) ActiveCount(ctx context.Context, obj *types.
 
 // Profile is the resolver for the profile field.
 func (r *trustCenterAccessResolver) Profile(ctx context.Context, obj *types.TrustCenterAccess) (*types.Profile, error) {
-	if err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, iam.ActionMembershipProfileGet); err != nil {
 		return nil, err
 	}
 
@@ -1063,11 +1059,11 @@ func (r *trustCenterAccessResolver) Profile(ctx context.Context, obj *types.Trus
 
 // AvailableDocumentAccesses is the resolver for the availableDocumentAccesses field.
 func (r *trustCenterAccessResolver) AvailableDocumentAccesses(ctx context.Context, obj *types.TrustCenterAccess, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterDocumentAccessOrderField]) (*types.TrustCenterDocumentAccessConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterAccessGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.TrustCenterDocumentAccessOrderField]{
@@ -1099,7 +1095,8 @@ func (r *trustCenterAccessResolver) Permission(ctx context.Context, obj *types.T
 
 // Document is the resolver for the document field.
 func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Document, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
@@ -1107,7 +1104,6 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t
 		return nil, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.TrustCenterAccessID)
 	prb := r.probo
 
 	document, err := prb.Documents.Get(ctx, scope, *obj.DocumentID)
@@ -1126,7 +1122,8 @@ func (r *trustCenterDocumentAccessResolver) Document(ctx context.Context, obj *t
 
 // Report is the resolver for the report field.
 func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.Report, error) {
-	if err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionReportGet); err != nil {
+	scope, err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionReportGet)
+	if err != nil {
 		return nil, err
 	}
 
@@ -1134,7 +1131,6 @@ func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *typ
 		return nil, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.TrustCenterAccessID)
 	prb := r.probo
 
 	report, err := prb.Reports.Get(ctx, scope, *obj.ReportID)
@@ -1148,7 +1144,8 @@ func (r *trustCenterDocumentAccessResolver) Report(ctx context.Context, obj *typ
 
 // TrustCenterFile is the resolver for the trustCenterFile field.
 func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.TrustCenterFile, error) {
-	if err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionTrustCenterFileGet); err != nil {
+	scope, err := r.authorize(ctx, obj.TrustCenterAccessID, probo.ActionTrustCenterFileGet)
+	if err != nil {
 		return nil, err
 	}
 
@@ -1156,7 +1153,6 @@ func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context,
 		return nil, nil
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.TrustCenterAccessID)
 	prb := r.probo
 
 	trustCenterFile, err := prb.TrustCenterFiles.Get(ctx, scope, *obj.TrustCenterFileID)
@@ -1170,11 +1166,11 @@ func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context,
 
 // TotalCount is the resolver for the totalCount field.
 func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterDocumentAccessConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterDocumentAccessList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterDocumentAccessList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	count, err := prb.TrustCenterAccesses.CountDocumentAccesses(ctx, scope, obj.ParentID)
@@ -1188,11 +1184,11 @@ func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Con
 
 // FileURL is the resolver for the fileUrl field.
 func (r *trustCenterFileResolver) FileURL(ctx context.Context, obj *types.TrustCenterFile) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileGetFileUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterFileGetFileUrl)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	fileURL, err := prb.TrustCenterFiles.GenerateFileURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -1206,11 +1202,11 @@ func (r *trustCenterFileResolver) FileURL(ctx context.Context, obj *types.TrustC
 
 // Organization is the resolver for the organization field.
 func (r *trustCenterFileResolver) Organization(ctx context.Context, obj *types.TrustCenterFile) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	trustCenterFile, err := prb.TrustCenterFiles.Get(ctx, scope, obj.ID)
@@ -1240,11 +1236,11 @@ func (r *trustCenterFileResolver) Permission(ctx context.Context, obj *types.Tru
 
 // TotalCount is the resolver for the totalCount field.
 func (r *trustCenterFileConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterFileConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterFileList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterFileList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	count, err := prb.TrustCenterFiles.CountForOrganizationID(ctx, scope, obj.ParentID)
@@ -1258,11 +1254,11 @@ func (r *trustCenterFileConnectionResolver) TotalCount(ctx context.Context, obj
 
 // LogoURL is the resolver for the logoUrl field.
 func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.TrustCenterReference) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceGetLogoUrl); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionTrustCenterReferenceGetLogoUrl)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	fileURL, err := prb.TrustCenterReferences.GenerateLogoURL(ctx, scope, obj.ID, 1*time.Hour)
@@ -1281,11 +1277,11 @@ func (r *trustCenterReferenceResolver) Permission(ctx context.Context, obj *type
 
 // TotalCount is the resolver for the totalCount field.
 func (r *trustCenterReferenceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterReferenceConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterReferenceList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionTrustCenterReferenceList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	count, err := prb.TrustCenterReferences.CountForTrustCenterID(ctx, scope, obj.ParentID)

pkg/server/api/console/v1/viewer_resolvers.go

@@ -22,11 +22,11 @@ import (
 
 // SignableDocuments is the resolver for the signableDocuments field.
 func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewer, organizationID gid.GID, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy) (*types.EmployeeDocumentConnection, error) {
-	if err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList); err != nil {
+	scope, err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(organizationID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
@@ -71,11 +71,11 @@ func (r *viewerResolver) SignableDocuments(ctx context.Context, obj *types.Viewe
 
 // SignableDocument is the resolver for the signableDocument field.
 func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer, id gid.GID) (*types.EmployeeDocument, error) {
-	if err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(id)
 	prb := r.probo
 
 	identity := authn.IdentityFromContext(ctx)
@@ -105,11 +105,11 @@ func (r *viewerResolver) SignableDocument(ctx context.Context, obj *types.Viewer
 
 // ApprovableDocuments is the resolver for the approvableDocuments field.
 func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Viewer, organizationID gid.GID, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.DocumentOrderBy) (*types.EmployeeDocumentConnection, error) {
-	if err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList); err != nil {
+	scope, err := r.authorize(ctx, organizationID, probo.ActionEmployeeDocumentList)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(organizationID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.DocumentOrderField]{
@@ -154,11 +154,11 @@ func (r *viewerResolver) ApprovableDocuments(ctx context.Context, obj *types.Vie
 
 // ApprovableDocument is the resolver for the approvableDocument field.
 func (r *viewerResolver) ApprovableDocument(ctx context.Context, obj *types.Viewer, id gid.GID) (*types.EmployeeDocument, error) {
-	if err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet); err != nil {
+	scope, err := r.authorize(ctx, id, probo.ActionEmployeeDocumentGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(id)
 	prb := r.probo
 
 	identity := authn.IdentityFromContext(ctx)

pkg/server/api/console/v1/webhook_resolvers.go

@@ -24,11 +24,11 @@ import (
 
 // CreateWebhookSubscription is the resolver for the createWebhookSubscription field.
 func (r *mutationResolver) CreateWebhookSubscription(ctx context.Context, input types.CreateWebhookSubscriptionInput) (*types.CreateWebhookSubscriptionPayload, error) {
-	if err := r.authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionCreate); err != nil {
+	scope, err := r.authorize(ctx, input.OrganizationID, probo.ActionWebhookSubscriptionCreate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.OrganizationID)
 	prb := r.probo
 
 	wc, err := prb.WebhookSubscriptions.Create(
@@ -56,11 +56,11 @@ func (r *mutationResolver) CreateWebhookSubscription(ctx context.Context, input
 
 // UpdateWebhookSubscription is the resolver for the updateWebhookSubscription field.
 func (r *mutationResolver) UpdateWebhookSubscription(ctx context.Context, input types.UpdateWebhookSubscriptionInput) (*types.UpdateWebhookSubscriptionPayload, error) {
-	if err := r.authorize(ctx, input.ID, probo.ActionWebhookSubscriptionUpdate); err != nil {
+	scope, err := r.authorize(ctx, input.ID, probo.ActionWebhookSubscriptionUpdate)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.ID)
 	prb := r.probo
 
 	wc, err := prb.WebhookSubscriptions.Update(
@@ -88,15 +88,14 @@ func (r *mutationResolver) UpdateWebhookSubscription(ctx context.Context, input
 
 // DeleteWebhookSubscription is the resolver for the deleteWebhookSubscription field.
 func (r *mutationResolver) DeleteWebhookSubscription(ctx context.Context, input types.DeleteWebhookSubscriptionInput) (*types.DeleteWebhookSubscriptionPayload, error) {
-	if err := r.authorize(ctx, input.WebhookSubscriptionID, probo.ActionWebhookSubscriptionDelete); err != nil {
+	scope, err := r.authorize(ctx, input.WebhookSubscriptionID, probo.ActionWebhookSubscriptionDelete)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(input.WebhookSubscriptionID)
 	prb := r.probo
 
-	err := prb.WebhookSubscriptions.Delete(ctx, scope, input.WebhookSubscriptionID)
-	if err != nil {
+	if err := prb.WebhookSubscriptions.Delete(ctx, scope, input.WebhookSubscriptionID); err != nil {
 		r.logger.ErrorCtx(ctx, "cannot delete webhook subscription", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
@@ -108,11 +107,11 @@ func (r *mutationResolver) DeleteWebhookSubscription(ctx context.Context, input
 
 // TotalCount is the resolver for the totalCount field.
 func (r *webhookEventConnectionResolver) TotalCount(ctx context.Context, obj *types.WebhookEventConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionGet)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	count, err := prb.WebhookSubscriptions.CountEventsForSubscriptionID(ctx, scope, obj.ParentID)
@@ -126,7 +125,7 @@ func (r *webhookEventConnectionResolver) TotalCount(ctx context.Context, obj *ty
 
 // Organization is the resolver for the organization field.
 func (r *webhookSubscriptionResolver) Organization(ctx context.Context, obj *types.WebhookSubscription) (*types.Organization, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, probo.ActionOrganizationGet); err != nil {
 		return nil, err
 	}
 
@@ -148,11 +147,11 @@ func (r *webhookSubscriptionResolver) Organization(ctx context.Context, obj *typ
 
 // SigningSecret is the resolver for the signingSecret field.
 func (r *webhookSubscriptionResolver) SigningSecret(ctx context.Context, obj *types.WebhookSubscription) (string, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionUpdate); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionUpdate)
+	if err != nil {
 		return "", err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	signingSecret, err := prb.WebhookSubscriptions.GetSigningSecret(ctx, scope, obj.ID)
@@ -166,11 +165,11 @@ func (r *webhookSubscriptionResolver) SigningSecret(ctx context.Context, obj *ty
 
 // Events is the resolver for the events field.
 func (r *webhookSubscriptionResolver) Events(ctx context.Context, obj *types.WebhookSubscription, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.WebhookEventOrderBy) (*types.WebhookEventConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionGet); err != nil {
+	scope, err := r.authorize(ctx, obj.ID, probo.ActionWebhookSubscriptionGet)
+	if err != nil {
 		return nil, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ID)
 	prb := r.probo
 
 	pageOrderBy := page.OrderBy[coredata.WebhookEventOrderField]{
@@ -202,11 +201,11 @@ func (r *webhookSubscriptionResolver) Permission(ctx context.Context, obj *types
 
 // TotalCount is the resolver for the totalCount field.
 func (r *webhookSubscriptionConnectionResolver) TotalCount(ctx context.Context, obj *types.WebhookSubscriptionConnection) (int, error) {
-	if err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionList); err != nil {
+	scope, err := r.authorize(ctx, obj.ParentID, probo.ActionWebhookSubscriptionList)
+	if err != nil {
 		return 0, err
 	}
 
-	scope := coredata.NewScopeFromObjectID(obj.ParentID)
 	prb := r.probo
 
 	switch obj.Resolver.(type) {

pkg/server/api/mcp/v1/resolver.go

@@ -57,10 +57,10 @@ func markdownToProseMirrorJSON(markdown string) (string, error) {
 	return string(out), nil
 }
 
-func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.Action) error {
+func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.Action) (*coredata.Scope, error) {
 	identity := authn.IdentityFromContext(ctx)
 
-	err := r.iamSvc.Authorizer.Authorize(
+	scope, err := r.iamSvc.Authorizer.Authorize(
 		ctx,
 		iam.AuthorizeParams{
 			Principal: identity.ID,
@@ -69,22 +69,22 @@ func (r *Resolver) Authorize(ctx context.Context, entityID gid.GID, action iam.A
 		},
 	)
 	if err == nil {
-		return nil
+		return scope, nil
 	}
 
 	if _, ok := errors.AsType[*iam.ErrInsufficientPermissions](err); ok {
-		return fmt.Errorf("permission denied")
+		return nil, fmt.Errorf("permission denied")
 	}
 
 	if _, ok := errors.AsType[*iam.ErrAssumptionRequired](err); ok {
-		return fmt.Errorf("assumption required")
+		return nil, fmt.Errorf("assumption required")
 	}
 
 	if errors.Is(err, coredata.ErrResourceNotFound) {
-		return fmt.Errorf("resource not found")
+		return nil, fmt.Errorf("resource not found")
 	}
 
 	r.logger.ErrorCtx(ctx, "cannot authorize MCP request", log.Error(err))
 
-	return fmt.Errorf("internal server error")
+	return nil, fmt.Errorf("internal server error")
 }