title: REST, caching, and authorizing with multiple user roles
body: <p>We have a multi-tenant system with multiple different levels of access--sometimes even for the same user as they switch between multiple roles.  We're beginning a discussion on moving over to a RESTful implementation of things.  I'm just starting to get my feet wet with the whole REST thing.</p>
  
  <p>So how do I go about limiting access to the correct records when they access a resource, particularly when taking caching into consideration?  If user A access <code>example.com/employees</code> they would receive a different response than user B; user A may even receive a different response as he switches to a different role.  To help facilitate caching, should the id of the role be somehow incorporated into the uri?  Maybe something like <code>example.com/employees/123</code> (which violates the rules of REST), or as some sort of subordinate resource like <code>example.com/employees/role/123</code> (which seems silly, since <code>role/###</code> is going to be appended to URIs all over the place).  I can help but think I'm missing something here.</p>
  
  <p><em>edited to mention multi-tenancy</em></p>