In which parts of the system is the user rights verification mechanism usually implemented?

The mechanism for checking user rights is usually implemented in the following parts of the system:

• At the controller or route level — access rights check before executing business logic.
• In the business logic layer — an additional check to ensure that operations are performed only by authorized users.
• At the database level — through access rights to tables, views, or stored procedures.

In PHP, rights checks are often implemented in middleware or at the beginning of controllers:

if (!userHasPermission($user, 'edit_post')) {
    http_response_code(403);
    exit('Access denied');
}

This approach provides multi-level protection and prevents unauthorized access.