I am working on a project where you have controllers that expose an API and services that implement some logic. In this project, each service* checks for the user's permissions to use the service. When asked, I am told it makes life easier to the service's consumers because they don't have to bother themselves with permissions. The code in this design looks like so@Post@Path('/addItem')public Response addItem(@RequestBody Item item){    itemHandler.add(item); // this call actually does the permissions verification}However, I am familiar with another design where controllers are responsible for permission checking before activating the service. This design keeps the services simple and unaware of any permissions mechanism, and the liability for security lies on the consumer. @Post@Path('/addItem')public Response addItem(@RequestBody Item item, Request request){    if (hasPermissions(request)){        itemHandler.add(item);  // is not concerned/aware of permissions.     }}I guess there are pros and cons for each. I am trying to find more material on the matter to decide if the current status in the project requires change or not. * service - meaning an object we are invoking. 
Who should be reliable for permissions check in a web app?
permissions