diff --git a/demo/lib/demo_web/item_actions/user_soft_delete.ex b/demo/lib/demo_web/item_actions/user_soft_delete.ex
index 0ccb3bd12..6bb6d338a 100644
--- a/demo/lib/demo_web/item_actions/user_soft_delete.ex
+++ b/demo/lib/demo_web/item_actions/user_soft_delete.ex
@@ -67,14 +67,23 @@ defmodule DemoWeb.ItemActions.UserSoftDelete do
       try do
         updates = [set: [deleted_at: datetime]]
 
+        # Backpex re-read these items and authorized exactly them under this action's key before
+        # calling handle/3, so the write does not check again.
         {:ok, _count} =
-          Backpex.Resource.update_all(items, updates, "deleted", socket.assigns.live_resource)
+          Backpex.Resource.update_all(items, updates, socket.assigns, socket.assigns.live_resource,
+            event_name: "deleted",
+            authorize?: false
+          )
 
-        # nullify the user_id in the posts owned by the users
+        # nullify the user_id in the posts owned by the users. This is a cascade write on another
+        # resource, not a user-initiated action on it, so it skips authorization deliberately.
         _nullified_posts =
           items
           |> Enum.map(fn item ->
-            Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], "updated", DemoWeb.PostLive)
+            Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], socket.assigns, DemoWeb.PostLive,
+              event_name: "updated",
+              authorize?: false
+            )
           end)
 
         socket
diff --git a/demo/test/demo_web/live/authorization_enforcement_test.exs b/demo/test/demo_web/live/authorization_enforcement_test.exs
new file mode 100644
index 000000000..7b5961f2f
--- /dev/null
+++ b/demo/test/demo_web/live/authorization_enforcement_test.exs
@@ -0,0 +1,386 @@
+defmodule DemoWeb.Live.AuthorizationEnforcementTest do
+  @moduledoc """
+  End-to-end checks that Backpex enforces `can?/3` server-side.
+
+  Every test here forges an event the UI would never send: the buttons are hidden or disabled, so
+  the only way to reach these code paths is a tampered payload.
+  """
+  use DemoWeb.ConnCase, async: false
+
+  import Demo.EctoFactory
+  import Phoenix.LiveViewTest
+
+  alias Demo.Post
+  alias Demo.Repo
+  alias Demo.ShortLink
+  alias Demo.User
+  alias Phoenix.LiveView.Socket
+
+  @moduletag :capture_log
+
+  setup do
+    # `live/2` links the LiveView to the test process. These tests deliberately make it crash, so
+    # the EXIT signal has to arrive as a message instead of killing the test.
+    Process.flag(:trap_exit, true)
+
+    :ok
+  end
+
+  defp assign_socket(assigns) do
+    Enum.reduce(assigns, %Socket{}, fn {key, value}, socket ->
+      Phoenix.Component.assign(socket, key, value)
+    end)
+  end
+
+  describe "forged item actions on a resource that denies the action" do
+    setup do
+      product = insert(:product)
+
+      {:ok, short_link} =
+        Repo.insert(%ShortLink{short_key: "forgedkey", url: "https://example.com", product_id: product.id})
+
+      %{short_link: short_link}
+    end
+
+    test "raises ForbiddenError and keeps the record", %{conn: conn, short_link: short_link} do
+      {:ok, view, _html} = live(conn, ~p"/admin/short-links")
+
+      assert {{%Backpex.ForbiddenError{}, _stacktrace}, _mfa} =
+               catch_exit(
+                 render_click(view, "item-action", %{"action-key" => "delete", "item-id" => short_link.short_key})
+               )
+
+      assert Repo.get_by(ShortLink, short_key: "forgedkey")
+    end
+  end
+
+  describe "forged item actions with a confirmation modal" do
+    test "an unauthorized item raises before the modal opens", %{conn: conn} do
+      admin = insert(:user, %{role: :admin})
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      assert {{%Backpex.ForbiddenError{}, _stacktrace}, _mfa} =
+               catch_exit(
+                 render_click(view, "item-action", %{"action-key" => "user_soft_delete", "item-id" => admin.id})
+               )
+
+      assert Repo.get(User, admin.id).deleted_at == nil
+    end
+
+    test "a nonexistent item id raises NoResultsError", %{conn: conn} do
+      insert(:user)
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      assert {{%Backpex.NoResultsError{}, _stacktrace}, _mfa} =
+               catch_exit(render_click(view, "item-action", %{"action-key" => "user_soft_delete", "item-id" => "0"}))
+    end
+  end
+
+  describe "forged action keys" do
+    test "an unknown key on a row raises NoResultsError, not ArgumentError", %{conn: conn} do
+      user = insert(:user)
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      assert {{%Backpex.NoResultsError{}, _stacktrace}, _mfa} =
+               catch_exit(
+                 render_click(view, "item-action", %{
+                   "action-key" => "no_such_backpex_item_action_key",
+                   "item-id" => user.id
+                 })
+               )
+    end
+
+    test "an unknown key on the toolbar raises NoResultsError, not ArgumentError", %{conn: conn} do
+      insert(:user)
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      assert {{%Backpex.NoResultsError{}, _stacktrace}, _mfa} =
+               catch_exit(render_click(view, "item-action", %{"action-key" => "another_missing_action_key"}))
+    end
+  end
+
+  describe "forged selection ids" do
+    test "an unknown id is ignored and never enters the selection", %{conn: conn} do
+      user = insert(:user)
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      # A nil in `selected_items` would blow up in DemoWeb.UserLive.can?/3 on the next render.
+      render_click(view, "update-selected-items", %{"id" => "0"})
+
+      assert has_element?(view, "button[phx-value-action-key='user_soft_delete'][disabled]")
+      refute has_element?(view, "#select-input-#{user.id}[checked]")
+
+      render_click(view, "update-selected-items", %{"id" => user.id})
+
+      assert has_element?(view, "#select-input-#{user.id}[checked]")
+      refute has_element?(view, "button[phx-value-action-key='user_soft_delete'][disabled]")
+    end
+  end
+
+  describe "mixed selections" do
+    setup do
+      %{user: insert(:user, %{role: :user}), admin: insert(:user, %{role: :admin})}
+    end
+
+    test "disable the bulk action button and say why", %{conn: conn, user: user, admin: admin} do
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      render_click(view, "update-selected-items", %{"id" => user.id})
+      refute has_element?(view, "button[phx-value-action-key='user_soft_delete'][disabled]")
+
+      # The admin's checkbox is disabled in the UI, so this selection can only be built by forging
+      # the event — but the button must still explain itself rather than being a dead end.
+      render_click(view, "update-selected-items", %{"id" => admin.id})
+
+      assert has_element?(view, "button[phx-value-action-key='user_soft_delete'][disabled]")
+
+      assert has_element?(
+               view,
+               "button[phx-value-action-key='user_soft_delete'][title='Your selection contains items you may not apply this action to.']"
+             )
+    end
+
+    test "an item no action applies to cannot be selected", %{conn: conn, user: user, admin: admin} do
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      # `user_soft_delete` is the only bulk action on users and it is denied for admins, so an
+      # admin row can never take part in one.
+      assert has_element?(view, "#select-input-#{admin.id}[disabled]")
+      refute has_element?(view, "#select-input-#{user.id}[disabled]")
+
+      assert has_element?(
+               view,
+               "#select-input-#{admin.id}[title='No action is available for this item.']"
+             )
+    end
+
+    test "select all skips items no action applies to", %{conn: conn, user: user, admin: admin} do
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      render_click(view, "toggle-item-selection", %{})
+
+      assert has_element?(view, "#select-input-#{user.id}[checked]")
+      refute has_element?(view, "#select-input-#{admin.id}[checked]")
+
+      # A select-all that produced an unusable selection would be the dead end this avoids.
+      refute has_element?(view, "button[phx-value-action-key='user_soft_delete'][disabled]")
+    end
+
+    test "empty selections say what to do instead of just being disabled", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      assert has_element?(
+               view,
+               "button[phx-value-action-key='user_soft_delete'][title='Select at least one item to use this action.']"
+             )
+    end
+
+    test "raise ForbiddenError when the bulk action is forged anyway", %{conn: conn, user: user, admin: admin} do
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      render_click(view, "update-selected-items", %{"id" => user.id})
+      render_click(view, "update-selected-items", %{"id" => admin.id})
+
+      assert {{%Backpex.ForbiddenError{}, _stacktrace}, _mfa} =
+               catch_exit(render_click(view, "item-action", %{"action-key" => "user_soft_delete"}))
+
+      assert Repo.get(User, user.id).deleted_at == nil
+      assert Repo.get(User, admin.id).deleted_at == nil
+    end
+
+    test "are re-checked on submit when the selection is widened after the modal opened", %{
+      conn: conn,
+      user: user,
+      admin: admin
+    } do
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      render_click(view, "update-selected-items", %{"id" => user.id})
+      render_click(view, "item-action", %{"action-key" => "user_soft_delete"})
+
+      assert has_element?(view, "#resource-form")
+
+      # The authorization state changes while the modal is open. Before the submit gate existed,
+      # the unauthorized item was silently filtered out and the action reported success.
+      render_click(view, "update-selected-items", %{"id" => admin.id})
+
+      assert {{%Backpex.ForbiddenError{}, _stacktrace}, _mfa} =
+               view
+               |> form("#resource-form", change: %{reason: "widened after opening"})
+               |> render_submit()
+               |> catch_exit()
+
+      assert Repo.get(User, user.id).deleted_at == nil
+      assert Repo.get(User, admin.id).deleted_at == nil
+    end
+  end
+
+  describe "the selection follows the rows it points at" do
+    setup %{conn: conn} do
+      user = insert(:user, %{role: :user})
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      render_click(view, "update-selected-items", %{"id" => user.id})
+      refute has_element?(view, "button[phx-value-action-key='user_soft_delete'][disabled]")
+
+      %{user: user, view: view}
+    end
+
+    test "an updated row is replaced in the selection, not only in the table", %{user: user, view: view} do
+      user |> Ecto.Changeset.change(role: :admin) |> Repo.update!()
+
+      send(view.pid, {"backpex:updated", user})
+      _html = render(view)
+
+      # The button reads the *selection* to decide. If the selection still held the `role: :user`
+      # snapshot it would stay enabled and lead straight into the submit gate.
+      assert has_element?(
+               view,
+               "button[phx-value-action-key='user_soft_delete'][title='Your selection contains items you may not apply this action to.']"
+             )
+    end
+
+    test "a deleted row leaves the selection", %{user: user, view: view} do
+      Repo.delete!(user)
+
+      send(view.pid, {"backpex:deleted", user})
+      _html = render(view)
+
+      assert has_element?(
+               view,
+               "button[phx-value-action-key='user_soft_delete'][title='Select at least one item to use this action.']"
+             )
+    end
+
+    test "a row that left the item query's scope leaves the selection too", %{user: user, view: view} do
+      # An update can take a row out of scope just as a delete removes it. Re-reading it returns
+      # nothing, so it must not linger in `items` or `selected_items` as `nil`.
+      user |> Ecto.Changeset.change(deleted_at: DateTime.utc_now(:second)) |> Repo.update!()
+
+      send(view.pid, {"backpex:updated", user})
+      html = render(view)
+
+      refute html =~ "select-input-#{user.id}"
+
+      assert has_element?(
+               view,
+               "button[phx-value-action-key='user_soft_delete'][title='Select at least one item to use this action.']"
+             )
+    end
+  end
+
+  describe "the selection is re-read before the submit gate" do
+    setup %{conn: conn} do
+      user = insert(:user, %{role: :user})
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users")
+
+      # Select the row and open the confirm modal. From here on `selected_items` holds a snapshot
+      # of the record as it was at this moment — every test below changes the row behind the
+      # LiveView's back, without a broadcast, so nothing refreshes it.
+      render_click(view, "update-selected-items", %{"id" => user.id})
+      render_click(view, "item-action", %{"action-key" => "user_soft_delete"})
+
+      assert has_element?(view, "#resource-form")
+
+      %{user: user, view: view}
+    end
+
+    test "a record that turned unauthorized while the modal was open raises on submit", %{user: user, view: view} do
+      # `DemoWeb.UserLive.can?/3` denies `:user_soft_delete` for admins. The snapshot in
+      # `selected_items` still says `role: :user`, so only re-reading the row catches this.
+      user |> Ecto.Changeset.change(role: :admin) |> Repo.update!()
+
+      assert {{%Backpex.ForbiddenError{}, _stacktrace}, _mfa} =
+               view
+               |> form("#resource-form", change: %{reason: "promoted while the modal was open"})
+               |> render_submit()
+               |> catch_exit()
+
+      assert Repo.get(User, user.id).deleted_at == nil
+    end
+
+    test "a record deleted while the modal was open raises NoResultsError on submit", %{user: user, view: view} do
+      Repo.delete!(user)
+
+      assert {{%Backpex.NoResultsError{}, _stacktrace}, _mfa} =
+               view
+               |> form("#resource-form", change: %{reason: "deleted while the modal was open"})
+               |> render_submit()
+               |> catch_exit()
+    end
+
+    test "a record that left the item query's scope raises NoResultsError on submit", %{user: user, view: view} do
+      # `DemoWeb.UserLive.item_query/3` hides soft-deleted users, so this row is gone as far as the
+      # resource is concerned even though it is still in the table.
+      user |> Ecto.Changeset.change(deleted_at: DateTime.utc_now(:second)) |> Repo.update!()
+
+      assert {{%Backpex.NoResultsError{}, _stacktrace}, _mfa} =
+               view
+               |> form("#resource-form", change: %{reason: "soft deleted while the modal was open"})
+               |> render_submit()
+               |> catch_exit()
+    end
+
+    test "handle/3 gets the re-read record, not the snapshot", %{conn: conn, user: user, view: view} do
+      # The user had no posts when the row was selected, so the snapshot's `posts` is `[]`.
+      # `DemoWeb.ItemActions.UserSoftDelete.handle/3` nullifies `user_id` on the posts it is
+      # handed — the post below can only be reached through the re-read record.
+      post = insert(:post, user: user)
+
+      result =
+        view
+        |> form("#resource-form", change: %{reason: "still allowed"})
+        |> render_submit()
+
+      assert {:ok, _view, html} = follow_redirect(result, conn)
+      assert html =~ "User has been deleted successfully."
+
+      assert Repo.get(User, user.id).deleted_at != nil
+      assert Repo.get(Post, post.id).user_id == nil
+    end
+  end
+
+  describe "resource actions" do
+    test "an authorized submit runs the action", %{conn: conn} do
+      insert(:user)
+
+      {:ok, view, _html} = live(conn, ~p"/admin/users/invite/resource-action")
+
+      result =
+        view
+        |> form("#resource-form", change: %{text: "Please join us"})
+        |> render_submit(%{"change" => %{"users" => ["user_id_alex"]}, "save-type" => "save"})
+
+      assert {:ok, _view, html} = follow_redirect(result, conn)
+      assert html =~ "An email has been successfully sent"
+    end
+
+    test "the submit gate raises when the action is denied while the form is open" do
+      # The route already refuses an action the user may not open, so the only way to reach the
+      # submit gate with a denial is a permission that changed while the modal was open. Drive the
+      # form component directly rather than pretend a demo resource can do that.
+      socket =
+        assign_socket(
+          live_action: :resource_action,
+          action_type: :resource,
+          live_resource: DemoWeb.InvoiceLive,
+          resource_action: %{module: DemoWeb.ResourceActions.Email},
+          resource_action_id: :invite,
+          fields: [],
+          item: %{},
+          return_to: "/admin/invoices"
+        )
+
+      assert_raise Backpex.ForbiddenError, fn ->
+        Backpex.FormComponent.handle_event("save", %{"change" => %{}, "save-type" => "save"}, socket)
+      end
+    end
+  end
+end
diff --git a/guides/actions/item-actions.md b/guides/actions/item-actions.md
index 92db78b4c..86b06b151 100644
--- a/guides/actions/item-actions.md
+++ b/guides/actions/item-actions.md
@@ -179,25 +179,30 @@ defmodule DemoWeb.ItemAction.SoftDelete do
 
     @impl Backpex.ItemAction
     def handle(socket, items, data) do
-      datetime = DateTime.truncate(DateTime.utc_now(), :second)
+      datetime = DateTime.utc_now(:second)
 
       socket =
         try do
-          {:ok, _count_} =
+          # Backpex already authorized exactly these items under this action's key, so this write
+          # does not check again. See "Authorization" below.
+          {:ok, _items} =
             Backpex.Resource.update_all(
-              socket.assigns,
               items,
               [set: [deleted_at: datetime, reason: data.reason]],
-              "deleted"
+              socket.assigns,
+              socket.assigns.live_resource,
+              event_name: "deleted",
+              authorize?: false
             )
 
-            socket
-            |> clear_flash()
-            |> put_flash(:info, "Item(s) successfully deleted.")
-        rescue
           socket
           |> clear_flash()
-          |> put_flash(:error, error)
+          |> put_flash(:info, "Item(s) successfully deleted.")
+        rescue
+          error ->
+            socket
+            |> clear_flash()
+            |> put_flash(:error, Exception.message(error))
         end
 
       {:ok, socket}
@@ -209,3 +214,66 @@ The above ItemAction require users to fill out the reason field before the actio
 
 > #### Important {: .note}
 > If your ItemAction has form fields, you must also implement the `c:Backpex.ItemAction.confirm/1` function.
+
+## Authorization
+
+Item actions are authorized against the key they are registered under. Implement [`can?/3`](Backpex.LiveResource.html#c:can?/3) in your resource configuration module:
+
+```elixir
+# in your resource configuration file
+@impl Backpex.LiveResource
+def can?(_assigns, :soft_delete, item), do: item.role != :admin
+def can?(_assigns, _action, _item), do: true
+```
+
+Backpex enforces this for you — you do not need to check it again inside `c:Backpex.ItemAction.handle/3`. There are five things to know:
+
+**Enforcement is strict.** A selection containing a single unauthorized item raises `Backpex.ForbiddenError`; items are never silently dropped. A stale or forged item id raises `Backpex.NoResultsError`. Raised from an event handler on a connected socket, either one crashes the LiveView and the client reloads — no error page and no message, only the guarantee that nothing was written. Users are kept away from the gates by the preflight checks, not by the gates' error reporting. Because a mixed selection would raise, the toolbar button is disabled whenever the selection is empty or contains an unauthorized item, and a row that is authorized for no bulk action at all cannot be selected.
+
+**Each gesture is authorized exactly once per step.** An action without a confirmation modal is authorized immediately before `c:Backpex.ItemAction.handle/3` runs. An action with one is authorized when the modal opens and again when it is submitted — the second check is deliberate, because a permission may be revoked, or the selection widened, while the modal is open.
+
+**The selection is re-read right before the execution gate.** A selection is a snapshot: rows are cached when they are selected, and a confirmation modal can stay open for as long as the user likes. Backpex therefore re-reads every selected item by its primary key immediately before the authoritative gate — the one that runs just before `c:Backpex.ItemAction.handle/3` — authorizes those fresh records, and hands *them* to `handle/3`. If another actor changed a row in the meantime, `can?/3` sees the new values, not the rendered ones. If a row was deleted, or left the resource's [`item_query/3`](item-query.html) scope, it comes back as `nil` and the gate raises `Backpex.NoResultsError` instead of writing to a record nobody checked. The re-read goes through the adapter, so `item_query/3` applies exactly as it does everywhere else.
+
+> #### The re-read is not a lock {: .warning}
+>
+> A window remains between the re-read and whatever `c:Backpex.ItemAction.handle/3` writes. Backpex deliberately does not open a transaction or lock the rows: your `handle/3` owns the write and decides what isolation it needs. An action that requires strict atomicity has to re-read and lock inside its own `handle/3` — for example in an `c:Ecto.Repo.transaction/2` with a `lock: "FOR UPDATE"` query.
+
+**`handle/3` gets the full selection, and is never called with `[]`.** For an empty selection Backpex skips the action entirely.
+
+**Inside `handle/3`, the items you were handed are already authorized.** They are the records Backpex just re-read, and the gate covered exactly those items under exactly this action's key — so a `Backpex.Resource` call that writes those same items should pass `authorize?: false`:
+
+```elixir
+Backpex.Resource.delete_all(items, socket.assigns, socket.assigns.live_resource, authorize?: false)
+```
+
+Anything else the action writes is *not* covered by that gate and keeps the default check. `Backpex.Resource` mutations default to `:new` / `:edit` / `:delete`; pass `:authorization_action` when a different key is the right one to check. `assigns.item_action_key` holds the key this action is registered under for the duration of the `handle/3` call — Backpex clears it again afterwards — so the action does not need to hardcode it:
+
+```elixir
+# writing other items of the same resource, under this action's key
+Backpex.Resource.update_all(other_items, updates, socket.assigns, socket.assigns.live_resource,
+  authorization_action: socket.assigns.item_action_key
+)
+```
+
+A cascade write to a *different* resource (nullifying a foreign key, for example) is not a user-initiated action on that resource at all — pass `authorize?: false`:
+
+```elixir
+Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], socket.assigns, MyAppWeb.PostLive,
+  event_name: "updated",
+  authorize?: false
+)
+```
+
+> #### Do not swallow the gate {: .warning}
+>
+> This only applies to `Backpex.Resource` calls that are still gated — the ones you did *not* pass `authorize?: false`. A broad `rescue` around such a call catches `Backpex.ForbiddenError` and `Backpex.NoResultsError` too, turning a refused write into an ordinary flash message: the request looks handled, and the failure is filed under "something went wrong" instead of "you may not do this". Reraise them:
+>
+> ```elixir
+> rescue
+>   error in [Backpex.ForbiddenError, Backpex.NoResultsError] ->
+>     reraise error, __STACKTRACE__
+>
+>   error ->
+>     # your own error handling
+> end
+> ```
diff --git a/guides/actions/resource-actions.md b/guides/actions/resource-actions.md
index 82c5e269e..e84857751 100644
--- a/guides/actions/resource-actions.md
+++ b/guides/actions/resource-actions.md
@@ -87,4 +87,25 @@ We validate the email address using the `validate_email/2` function provided by
 
 > #### Info {: .info}
 >
-> Each resource action has its own route. The route is defined by the `id` of the resource action. If you use the [`live_resource/3`](Backpex.Router.html#live_resources/3) macro, the route is automatically added to the live resource.
\ No newline at end of file
+> Each resource action has its own route. The route is defined by the `id` of the resource action. If you use the [`live_resource/3`](Backpex.Router.html#live_resources/3) macro, the route is automatically added to the live resource.
+
+## Authorization
+
+A resource action is authorized against its `id`, with a `nil` item:
+
+```elixir
+# in your resource configuration file
+@impl Backpex.LiveResource
+def can?(assigns, :invite, _item), do: assigns.current_user.role == :admin
+def can?(_assigns, _action, _item), do: true
+```
+
+Backpex checks this twice: when the modal is opened (the button is not rendered at all when the check fails, and the route itself refuses) and again when the form is submitted, so a permission revoked while the form was open cannot be used. An unauthorized submit raises `Backpex.ForbiddenError`, which crashes the LiveView and reloads the client — the write does not happen, and the user is not shown a 403 page or a message. See [Authorization](live-resource-authorization.html) for the details.
+
+If your [`handle/2`](Backpex.ResourceAction.html#c:handle/2) calls `Backpex.Resource` functions, note that those authorize against their own defaults — `:new` for `insert/6`, `:edit` for `update/6` and `update_all/5`, `:delete` for `delete_all/4` — not against the resource action's key. Pass `authorization_action:` when the resource action's own key is the right one to check, or `authorize?: false` when the write is a system side effect rather than a user action on that resource:
+
+```elixir
+Backpex.Resource.update_all(items, updates, socket.assigns, MyAppWeb.UserLive,
+  authorization_action: :invite
+)
+```
\ No newline at end of file
diff --git a/guides/authorization/live-resource-authorization.md b/guides/authorization/live-resource-authorization.md
index a3cd9542a..84465c05c 100644
--- a/guides/authorization/live-resource-authorization.md
+++ b/guides/authorization/live-resource-authorization.md
@@ -50,4 +50,97 @@ The `can?` callback receives the following parameters:
 
 ## Return value
 
-The `can?` callback must return a boolean value. If the return value is `true`, the action is allowed. If the return value is `false`, the action is denied.
\ No newline at end of file
+The `can?` callback must return a boolean value. If the return value is `true`, the action is allowed. If the return value is `false`, the action is denied.
+
+## Enforcement
+
+Backpex enforces `can?/3` centrally, through `Backpex.Authorization`. You do not need to repeat the check in your own actions.
+
+There are two kinds of checks, and both run:
+
+- **Preflight** — decides whether a control is rendered or disabled. A user never sees a button for something they may not do.
+- **Gate** — runs immediately before something happens and raises `Backpex.ForbiddenError` when it fails. This is what makes a forged or stale event safe.
+
+> #### What a denial looks like {: .info}
+>
+> `Backpex.ForbiddenError` and `Backpex.NoResultsError` carry a `plug_status` of 403 and 404, but Phoenix LiveView only maps that to an HTTP status while a view **mounts** — the dead render. Raised from an event handler on a connected socket (which is where the item and resource action gates live), the LiveView process crashes and the client reloads the page. The user gets no error page and no flash message.
+>
+> That is the intended outcome: the point of a gate is that the write does not happen. Do not rely on it to communicate anything — a user should never reach a gate through the UI in the first place, because the preflight checks already hid or disabled the control.
+
+### Where the gates are
+
+| what happens | action checked | item |
+| --- | --- | --- |
+| `:index` / `:show` view mounts | `:index` / `:show` | the item, for `:show` |
+| `:new` / `:edit` form mounts | `:new` / `:edit` | the item, for `:edit` |
+| `Backpex.Resource.insert/6` | `:new` | `nil` |
+| `Backpex.Resource.update/6` | `:edit` | the item |
+| `Backpex.Resource.update_all/5` | `:edit` | each item |
+| `Backpex.Resource.delete_all/4` | `:delete` | each item |
+| item action without a confirm modal, before `handle/3` runs | the action key | each selected item, **re-read** |
+| item action with a confirm modal, on open | the action key | each selected item, as rendered |
+| item action with a confirm modal, on submit | the action key | each selected item, **re-read** |
+| resource action, on open and on submit | the action key | `nil` |
+
+The `Backpex.Resource` gates run **before** the changeset is built and before `c:Backpex.Field.before_changeset/6` is called, so your own code never executes for an unauthorized request.
+
+Each gesture runs exactly one gate per step, so `can?/3` is not evaluated more times than there are decisions to make. A modal flow has two steps on purpose: the second check catches a permission revoked, or a selection widened, while the modal was open.
+
+### Item action gates re-read the selection
+
+A selection is a snapshot. Rows are cached in `selected_items` when they are selected, and a confirmation modal can stay open indefinitely. Authorizing that snapshot would mean checking values that may no longer be true, while the write that follows addresses the row by its primary key — so a record another actor changed in the meantime would be mutated under a permission it no longer has.
+
+Backpex therefore re-reads every selected item by its primary key immediately before the authoritative gate, checks `can?/3` against the **re-read** records, and passes those same records to `c:Backpex.ItemAction.handle/3`. Both execution paths do this: the direct dispatch of a confirm-less action, and the submit of a confirmation modal. The re-read goes through the adapter, so [`item_query/3`](item-query.html) applies — a row that was deleted, or that has left the query's scope, comes back as `nil` and raises `Backpex.NoResultsError`.
+
+The check when the modal *opens* is deliberately not re-read: it only decides whether the dialog appears, and the submit gate is the one that authorizes the write.
+
+> #### A re-read is not a lock {: .warning}
+>
+> A window remains between the re-read and whatever `c:Backpex.ItemAction.handle/3` writes. Backpex does not open a transaction or lock the rows here — `handle/3` owns the write and decides what isolation it needs. An action that requires strict atomicity has to re-read and lock inside its own `handle/3`, for example in an `c:Ecto.Repo.transaction/2` with a `lock: "FOR UPDATE"` query.
+
+### Strict semantics
+
+Checks over a selection are strict: a single unauthorized item raises, and nothing runs. Backpex does not silently drop items from a selection.
+
+A `nil` item — a stale or forged id — raises `Backpex.NoResultsError` and never reaches your `can?/3`, so you do not need clauses for it.
+
+Because a mixed selection would raise, the bulk action button is disabled whenever the selection is empty or contains any unauthorized item. A row that is authorized for none of the bulk actions cannot be selected at all — its checkbox is disabled, so a user cannot build a selection that has no usable action.
+
+### What `handle/3` may assume
+
+The items handed to `c:Backpex.ItemAction.handle/3` are the records Backpex just re-read, and they have already been authorized under that action's key. Writing exactly those items back is the same decision the gate just made, so pass `authorize?: false` rather than paying for a second evaluation of your `can?/3`:
+
+```elixir
+Backpex.Resource.delete_all(items, socket.assigns, socket.assigns.live_resource, authorize?: false)
+```
+
+The guarantee covers only those items under that key. Writes to *other* items or to another resource keep the default gate.
+
+### Overriding the action and the escape hatch
+
+Every `Backpex.Resource` mutation accepts two options:
+
+- `:authorization_action` — authorize against this action instead of the default. It must be a non-nil atom. Item actions can pass `socket.assigns.item_action_key`, so an action registered under a custom key is authorized under that key. Backpex sets that assign just before calling `c:Backpex.ItemAction.handle/3` and clears it again when the call returns, so it is meaningful for exactly one dispatch.
+- `authorize?: false` — skip the check. Use this for a write the gate already covered (see above), and for system or cascade writes that are not a user-initiated action on the resource being written, for example nullifying a foreign key on another resource.
+
+```elixir
+Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], socket.assigns, MyAppWeb.PostLive,
+  event_name: "updated",
+  authorize?: false
+)
+```
+
+### Reads are not gated in `Backpex.Resource`
+
+`Backpex.Resource.list/4`, `get/4`, `count/4` and `reload/4` do not call `can?/3`. Row-level read filtering belongs in [`item_query/3`](item-query.html) — dropping rows after pagination would corrupt item counts and select-all. `:index` and `:show` are enforced when the view mounts. `reload/4` is the read the item action gates use before they authorize; it is the gate that follows it, not the read, that raises.
+
+### Calling the checks yourself
+
+If you build your own UI on top of Backpex, use `Backpex.Authorization` rather than calling `can?/3` directly:
+
+```elixir
+Backpex.Authorization.can?(live_resource, assigns, :edit, item)
+Backpex.Authorization.can_all?(live_resource, assigns, :delete, items)
+Backpex.Authorization.authorize!(live_resource, assigns, :edit, item)
+Backpex.Authorization.authorize_all!(live_resource, assigns, :delete, items)
+```
\ No newline at end of file
diff --git a/guides/upgrading/v0.21.md b/guides/upgrading/v0.21.md
new file mode 100644
index 000000000..2cd844408
--- /dev/null
+++ b/guides/upgrading/v0.21.md
@@ -0,0 +1,254 @@
+# Upgrading to v0.21
+
+## Bump Your Deps
+
+Update Backpex to the latest version:
+
+```elixir
+defp deps do
+  [
+    {:backpex, "~> 0.21.0"}
+  ]
+end
+```
+
+v0.21 makes authorization something Backpex enforces rather than something every
+call site has to remember. `c:Backpex.LiveResource.can?/3` is now evaluated
+centrally — in `Backpex.Resource` before any mutation, and directly before every
+item and resource action runs.
+
+If you never call `Backpex.Resource` yourself and never wrote a custom item
+action, the only change you may notice is that a few forged or stale interactions
+now raise instead of silently doing nothing. If you do, read on: two function
+signatures changed.
+
+## 1. Security fix: the item action key no longer comes from the DOM
+
+> #### Security {: .error}
+>
+> Before v0.21, submitting an item action modal read the action key from the
+> `phx-value-action-key` DOM parameter. The `can?/3` check ran against that
+> client-supplied key while the server executed the module stored in
+> `action_to_confirm` — a client could pass the key of an action it *is* allowed
+> to perform and have a different, unauthorized action executed. This was
+> actively bypassable, not merely easy to forget.
+
+The key is now taken from `socket.assigns.action_to_confirm.key`, which the view
+sets when it opens the modal, and `phx-value-action-key` has been removed from
+the form. Nothing to do on your side unless you rendered Backpex's form component
+yourself with a hand-built `action-key` value.
+
+Client-supplied action keys are also no longer passed through
+`String.to_existing_atom/1`. They are matched against the registered
+`item_actions/1` and `resource_actions/0` keys, so an unknown key raises
+`Backpex.NoResultsError` (404) instead of an `ArgumentError`.
+
+## 2. `delete_all/2` → `delete_all/4`
+
+`delete_all` needs the assigns to authorize the deletion.
+
+```diff
+- Backpex.Resource.delete_all(items, socket.assigns.live_resource)
++ Backpex.Resource.delete_all(items, socket.assigns, socket.assigns.live_resource)
+```
+
+## 3. `update_all/3` and `update_all/4` → `update_all/5`
+
+`update_all` also needs the assigns, and `event_name` moved into the options.
+The old head had a default argument (`event_name \\ "updated"`), so it defined
+both an arity-3 and an arity-4 function. Both are gone:
+
+```diff
+- Backpex.Resource.update_all(items, updates, MyAppWeb.UserLive)
++ Backpex.Resource.update_all(items, updates, socket.assigns, MyAppWeb.UserLive)
+
+- Backpex.Resource.update_all(items, updates, "deleted", MyAppWeb.UserLive)
++ Backpex.Resource.update_all(items, updates, socket.assigns, MyAppWeb.UserLive, event_name: "deleted")
+```
+
+> #### Watch the argument order {: .warning}
+>
+> The two old forms fail differently, and neither fails silently:
+>
+> * `update_all(items, updates, MyAppWeb.UserLive)` raises
+>   `UndefinedFunctionError` — there is no `update_all/3` any more.
+> * `update_all(items, updates, "deleted", MyAppWeb.UserLive)` has the same arity
+>   as the new `update_all(items, updates, assigns, live_resource)`. A guard
+>   (`is_map(assigns) and not is_struct(assigns)`) makes it raise
+>   `FunctionClauseError` instead of quietly authorizing against the event name
+>   string.
+>
+> The same guard also rejects `socket` where `socket.assigns` belongs. If you see
+> either error, you missed a call site.
+
+## 4. Central enforcement and default actions
+
+Every mutation in `Backpex.Resource` now authorizes before it does anything else
+— before the changeset is built and before `c:Backpex.Field.before_changeset/6`
+runs, so your own code never executes for an unauthorized request.
+
+| function | authorizes | item passed to `can?/3` |
+| --- | --- | --- |
+| `insert/6` | `:new` | `nil` |
+| `update/6` | `:edit` | the item |
+| `update_all/5` | `:edit` | each item |
+| `delete_all/4` | `:delete` | each item |
+
+Note that `insert/6` checks with `nil`, consistent with every other `:new` check
+in Backpex. A clause like `def can?(_assigns, :new, nil), do: false` is now
+honored on save, not only when the form is opened.
+
+Reads (`list/4`, `get/4`, `count/4`) are **not** authorized here. `:index` and
+`:show` are still enforced in the view layer — filtering rows after pagination
+would corrupt counts and select-all.
+
+### What an item action's `handle/3` may assume
+
+Backpex calls `c:Backpex.ItemAction.handle/3` only after the gate authorized
+**exactly those items under exactly that action's key**. The items you receive
+are the ones the gate re-read from the data layer, not the snapshot that was
+rendered. Writing those same items back is the decision the gate already made,
+so pass `authorize?: false` instead of paying for a second evaluation of your
+`can?/3`:
+
+```elixir
+def handle(socket, items, _data) do
+  # already authorized by Backpex before this ran
+  Backpex.Resource.delete_all(items, socket.assigns, socket.assigns.live_resource, authorize?: false)
+
+  {:ok, socket}
+end
+```
+
+The guarantee covers nothing else. Writes to *other* items, or to another
+resource, keep the default gate.
+
+### Overriding the action: `:authorization_action`
+
+When an action writes items the gate did not cover, `:authorization_action`
+picks the key to check instead of the `:new` / `:edit` / `:delete` default:
+
+```elixir
+Backpex.Resource.update_all(other_items, updates, socket.assigns, socket.assigns.live_resource,
+  authorization_action: socket.assigns.item_action_key
+)
+```
+
+`assigns.item_action_key` is new in v0.21. Backpex sets it immediately before
+calling `c:Backpex.ItemAction.handle/3` and clears it again afterwards, so it is
+meaningful exactly for the duration of one dispatch and the action does not need
+to know which key it was registered under.
+
+The option must be a non-nil atom; anything else raises `ArgumentError` rather
+than reaching a permissive catch-all `can?/3` clause.
+
+### Skipping the check: `authorize?: false`
+
+System and cascade writes are not user-initiated actions on the resource they
+touch. Skip the check explicitly:
+
+```elixir
+# nullify the foreign key on another resource
+Backpex.Resource.update_all(item.posts, [set: [user_id: nil]], socket.assigns, MyAppWeb.PostLive,
+  event_name: "updated",
+  authorize?: false
+)
+```
+
+The option is deliberately explicit and greppable. Reach for it only when the
+write is already covered by the gate, or when it really is not the user's action
+on that resource.
+
+## 5. Item actions are strict now
+
+Previously, an item action silently filtered unauthorized items out of the
+selection and then ran `handle/3` with what was left — including an empty list,
+which usually reported success. That is gone.
+
+* A selection containing a single unauthorized item raises
+  `Backpex.ForbiddenError`. Nothing runs.
+* A stale or forged item id raises `Backpex.NoResultsError`. `nil` never
+  reaches your `can?/3`.
+* An unknown action key raises `Backpex.NoResultsError`.
+* `handle/3` receives the **full** list of selected items, and is not called at
+  all for an empty selection.
+* The bulk action button in the toolbar is disabled when the selection is empty
+  **or** contains any unauthorized item, so the UI never offers a click that
+  would raise. Its `title` says why.
+* A row that is authorized for none of the bulk actions can no longer be
+  selected: its checkbox is disabled, and "select all" skips it. Without this a
+  user could build a selection whose every action is disabled, with no way to
+  tell which row caused it.
+
+Three consequences worth knowing:
+
+* **A raised gate is not an error page.** Both exceptions carry a `plug_status`,
+  but LiveView only maps that to an HTTP status while a view mounts. From an
+  event handler on a connected socket the LiveView process crashes and the client
+  reloads the page — no 403 page, no flash. That is intended: the gate exists so
+  the write does not happen, not to explain itself. The preflight checks are what
+  keep a user from reaching a gate through the UI at all.
+* **Double-clicking a delete button** after the item is gone now raises
+  `Backpex.NoResultsError` — the LiveView crashes and reconnects instead of
+  flashing "0 items deleted". This is a deliberate trade-off for not leaking
+  whether an id exists.
+* **The execution gate checks re-read records, not the rendered ones.** Right
+  before it authorizes, Backpex re-reads every selected item by its primary key
+  through the adapter, checks `can?/3` against those records and passes them to
+  `handle/3`. A row another actor changed while the confirmation modal was open
+  is judged by its current values; a row that was deleted, or that has left the
+  resource's `item_query/3` scope, comes back as `nil` and raises
+  `Backpex.NoResultsError`. The check when the modal *opens* still uses the
+  rendered items — it only decides whether the dialog appears.
+
+  This is not a lock. A window remains between the re-read and whatever your
+  `handle/3` writes; Backpex opens no transaction and takes no row locks there.
+  An action that needs strict atomicity has to re-read and lock inside its own
+  `handle/3` (`c:Ecto.Repo.transaction/2` plus a `lock: "FOR UPDATE"` query).
+
+## 6. `handle_item_action/5` behavior change
+
+`Backpex.ItemAction.handle_item_action/5` is public. It no longer filters items;
+it re-reads them, authorizes them and raises. If you call it yourself, expect
+`Backpex.ForbiddenError` / `Backpex.NoResultsError` where you previously got a
+shorter list, and expect `c:Backpex.ItemAction.handle/3` to receive the re-read
+records rather than the list you passed in. `Backpex.ItemAction.authorize_fresh!/3`
+is that re-read-then-authorize step on its own, and `Backpex.ItemAction.dispatch/5`
+remains the unguarded "just run it" primitive.
+
+## 7. Do not let a `rescue` swallow the gate
+
+This applies to `Backpex.Resource` calls that are still gated — the ones you did
+*not* pass `authorize?: false`. A broad `rescue` around such a call now catches
+`Backpex.ForbiddenError` and `Backpex.NoResultsError` as well, turning a refused
+write into an ordinary flash message. That is worse than the crash it replaces:
+the request looks handled, and the failure is filed under "something went wrong"
+instead of "you may not do this". Reraise them:
+
+```elixir
+def handle(socket, items, _data) do
+  # ...
+rescue
+  error in [Backpex.ForbiddenError, Backpex.NoResultsError] ->
+    reraise error, __STACKTRACE__
+
+  error ->
+    # your existing error handling
+end
+```
+
+## Checklist for custom actions
+
+- [ ] Every `delete_all/2` call updated to `delete_all/4`.
+- [ ] Every `update_all/3` **and** `update_all/4` call updated to `update_all/5`,
+      with `event_name:` moved into the options. The arity-3 form raises
+      `UndefinedFunctionError`, the arity-4 form `FunctionClauseError`.
+- [ ] Item actions that write back the items they were handed pass
+      `authorize?: false` — the gate already covered them.
+- [ ] Writes to *other* items pass `authorization_action:` when the default
+      `:new` / `:edit` / `:delete` is not the right key.
+- [ ] Cascade or system writes pass `authorize?: false`.
+- [ ] Broad `rescue` clauses around a *still-gated* `Backpex.Resource` call
+      reraise `Backpex.ForbiddenError` and `Backpex.NoResultsError`.
+- [ ] `handle/3` implementations cope with receiving the full selection (they are
+      no longer handed a pre-filtered list, and are never called with `[]`).
diff --git a/lib/backpex/authorization.ex b/lib/backpex/authorization.ex
new file mode 100644
index 000000000..687ca16ff
--- /dev/null
+++ b/lib/backpex/authorization.ex
@@ -0,0 +1,103 @@
+defmodule Backpex.Authorization do
+  @moduledoc """
+  Central entry point for all Backpex authorization checks.
+
+  Every check ultimately calls `c:Backpex.LiveResource.can?/3` on the given LiveResource. Routing all
+  checks through this module gives Backpex a single place to enforce authorization — and a single
+  place to extend it later (for example with a dedicated authorizer behaviour).
+
+  There are two flavours of functions:
+
+  * **Preflight** (`can?/4`, `can_all?/4`) — answer a question. Use these in the UI to decide whether
+    to render or disable a control.
+  * **Gates** (`authorize!/4`, `authorize_all!/4`) — enforce the answer. Use these right before
+    something actually happens. They raise instead of returning `false`.
+
+  A gate is only as current as the item you hand it. Where the item comes from a cached selection
+  that may be minutes old — an item action, above all — re-read it first, so the check answers for
+  the record the write will actually touch. `Backpex.ItemAction.authorize_fresh!/3` pairs
+  `Backpex.Resource.reload/4` with `authorize_all!/4` for exactly that.
+
+  ## Failure semantics
+
+  * unauthorized → `Backpex.ForbiddenError`
+  * `nil` item in `authorize_all!/4` (a stale or forged item id) → `Backpex.NoResultsError`
+
+  A `nil` item never reaches `c:Backpex.LiveResource.can?/3` through `authorize_all!/4`. This keeps
+  user implementations free of `nil` clauses they never asked for, and it does not leak whether an
+  id exists.
+
+  Both exceptions carry a `plug_status` (403 and 404), but Phoenix LiveView only turns that into an
+  HTTP status while a view mounts — that is, on the dead render. Raised from `handle_event/3` on a
+  connected socket, the LiveView process crashes and the client reloads the page: the user sees no
+  error page and no message. What a gate guarantees is that the operation did not happen, not that
+  anyone is told why.
+
+  ## Strict semantics
+
+  `can_all?/4` and `authorize_all!/4` are strict: a single unauthorized item makes the whole call
+  fail. Backpex does not silently drop unauthorized items from a selection.
+
+  Note that `Enum.all?/2` returns `true` for an empty list, so an empty selection passes vacuously.
+  Callers that need "empty means not allowed" (a disabled bulk action button, for example) must
+  handle the empty case themselves.
+
+  ## Assigns, not the socket
+
+  Every function here takes `assigns`, not a `%Phoenix.LiveView.Socket{}`. A guard enforces that:
+  passing the socket by mistake would authorize against the wrong context, and a struct must fail
+  loudly rather than reach a permissive `c:Backpex.LiveResource.can?/3` clause.
+  """
+
+  @doc """
+  Returns whether `action` may be performed on `item` for the given LiveResource.
+
+  Pass `nil` as `item` for actions that are not bound to a specific item (`:index`, `:new`, resource
+  actions).
+  """
+  @spec can?(module(), map(), atom(), map() | nil) :: boolean()
+  def can?(live_resource, assigns, action, item)
+      when is_atom(live_resource) and is_map(assigns) and not is_struct(assigns) and is_atom(action) do
+    live_resource.can?(assigns, action, item)
+  end
+
+  @doc """
+  Returns whether `action` may be performed on **every** item in `items`.
+
+  Returns `true` for an empty list.
+  """
+  @spec can_all?(module(), map(), atom(), list()) :: boolean()
+  def can_all?(live_resource, assigns, action, items) when is_list(items) do
+    Enum.all?(items, &can?(live_resource, assigns, action, &1))
+  end
+
+  @doc """
+  Ensures `action` may be performed on `item`, raising `Backpex.ForbiddenError` otherwise.
+
+  Returns `:ok`.
+  """
+  @spec authorize!(module(), map(), atom(), map() | nil) :: :ok
+  def authorize!(live_resource, assigns, action, item) do
+    if can?(live_resource, assigns, action, item) do
+      :ok
+    else
+      raise Backpex.ForbiddenError
+    end
+  end
+
+  @doc """
+  Ensures `action` may be performed on **every** item in `items`.
+
+  Raises `Backpex.ForbiddenError` when any item is not authorized and `Backpex.NoResultsError` when
+  the list contains `nil` (a stale or forged item id).
+
+  Returns `:ok`. An empty list passes.
+  """
+  @spec authorize_all!(module(), map(), atom(), list()) :: :ok
+  def authorize_all!(live_resource, assigns, action, items) when is_list(items) do
+    Enum.each(items, fn
+      nil -> raise Backpex.NoResultsError
+      item -> authorize!(live_resource, assigns, action, item)
+    end)
+  end
+end
diff --git a/lib/backpex/field.ex b/lib/backpex/field.ex
index b73072605..b8f7cd54e 100644
--- a/lib/backpex/field.ex
+++ b/lib/backpex/field.ex
@@ -424,10 +424,9 @@ defmodule Backpex.Field do
   def handle_index_editable(socket, value, change) do
     %{assigns: %{item: item, fields: fields, live_resource: live_resource} = assigns} = socket
 
-    if not live_resource.can?(assigns, :edit, item) do
-      raise Backpex.ForbiddenError
-    end
-
+    # No `can?/3` check here: `Backpex.Resource.update/6` enforces `:edit` with the same assigns and
+    # item, before the changeset runs. Checking here as well would evaluate user code twice per
+    # inline edit for no added protection.
     opts = [
       after_save_fun: fn item ->
         live_resource.on_item_updated(socket, item)
diff --git a/lib/backpex/fields/belongs_to.ex b/lib/backpex/fields/belongs_to.ex
index 2dba75eb1..79381d9ef 100644
--- a/lib/backpex/fields/belongs_to.ex
+++ b/lib/backpex/fields/belongs_to.ex
@@ -62,6 +62,7 @@ defmodule Backpex.Fields.BelongsTo do
   """
   use Backpex.Field, config_schema: @config_schema
   import Ecto.Query
+  alias Backpex.Authorization
   alias Backpex.Router
 
   @impl Phoenix.LiveComponent
@@ -238,7 +239,7 @@ defmodule Backpex.Fields.BelongsTo do
     live_resource = Map.get(field_options, :live_resource)
 
     link =
-      if live_resource && live_resource.can?(assigns, :show, value) do
+      if live_resource && Authorization.can?(live_resource, assigns, :show, value) do
         Router.get_path(socket, live_resource, params, :show, value)
       end
 
diff --git a/lib/backpex/fields/has_many.ex b/lib/backpex/fields/has_many.ex
index f4b815ad8..22c0e5279 100644
--- a/lib/backpex/fields/has_many.ex
+++ b/lib/backpex/fields/has_many.ex
@@ -81,6 +81,7 @@ defmodule Backpex.Fields.HasMany do
   import Ecto.Query
 
   alias Backpex.Adapters.Ecto, as: EctoAdapter
+  alias Backpex.Authorization
   alias Backpex.HTML.Form
   alias Backpex.Router
 
@@ -456,7 +457,7 @@ defmodule Backpex.Fields.HasMany do
     } = assigns
 
     link =
-      if link_assocs and field_options.live_resource.can?(assigns, :show, item) do
+      if link_assocs and Authorization.can?(field_options.live_resource, assigns, :show, item) do
         Router.get_path(socket, Map.get(field_options, :live_resource), params, :show, item)
       end
 
diff --git a/lib/backpex/fields/inline_crud.ex b/lib/backpex/fields/inline_crud.ex
index 9f9918df5..506b3c0f9 100644
--- a/lib/backpex/fields/inline_crud.ex
+++ b/lib/backpex/fields/inline_crud.ex
@@ -92,6 +92,7 @@ defmodule Backpex.Fields.InlineCRUD do
   """
   use Backpex.Field, config_schema: @config_schema
 
+  alias Backpex.Authorization
   alias Backpex.Router
 
   require Backpex
@@ -261,7 +262,7 @@ defmodule Backpex.Fields.InlineCRUD do
   defp get_link(assigns, row) do
     live_resource = Map.get(assigns.field_options, :live_resource)
 
-    if live_resource && live_resource.can?(assigns, :show, row) do
+    if live_resource && Authorization.can?(live_resource, assigns, :show, row) do
       Router.get_path(assigns.socket, live_resource, assigns.params, :show, row)
     end
   end
diff --git a/lib/backpex/html/resource.ex b/lib/backpex/html/resource.ex
index 85cff7093..e14da7852 100644
--- a/lib/backpex/html/resource.ex
+++ b/lib/backpex/html/resource.ex
@@ -9,6 +9,7 @@ defmodule Backpex.HTML.Resource do
   import Backpex.HTML.Layout
   import Phoenix.LiveView.TagEngine
 
+  alias Backpex.Authorization
   alias Backpex.LiveResource
   alias Backpex.ResourceAction
   alias Backpex.Router
@@ -105,7 +106,7 @@ defmodule Backpex.HTML.Resource do
     {_name, field_options} = field = Enum.find(fields, fn {field_name, _field_options} -> field_name == name end)
 
     readonly =
-      not live_resource.can?(assigns, :edit, item) or
+      not Authorization.can?(live_resource, assigns, :edit, item) or
         Backpex.Field.readonly?(field_options, assigns)
 
     assigns =
@@ -875,7 +876,10 @@ defmodule Backpex.HTML.Resource do
   def resource_buttons(assigns) do
     ~H"""
     <div class="mb-4 flex space-x-2">
-      <.link :if={@live_resource.can?(assigns, :new, nil)} patch={Router.get_path(@socket, @live_resource, @params, :new)}>
+      <.link
+        :if={Authorization.can?(@live_resource, assigns, :new, nil)}
+        patch={Router.get_path(@socket, @live_resource, @params, :new)}
+      >
         <button class="btn btn-sm btn-outline btn-primary">
           {@create_button_label}
         </button>
@@ -893,9 +897,10 @@ defmodule Backpex.HTML.Resource do
       <div :if={display_divider?(assigns)} class="border-base-300 my-0.5 border-r-2 border-solid" />
 
       <button
-        :for={{key, action} <- filter_item_actions(@item_actions, :index)}
+        :for={{key, action, disabled_reason} <- index_action_buttons(assigns)}
         class="btn btn-sm btn-outline btn-primary"
-        disabled={action_disabled?(assigns, key, @selected_items)}
+        disabled={disabled_reason != nil}
+        title={disabled_reason}
         phx-click="item-action"
         phx-value-action-key={key}
       >
@@ -951,7 +956,7 @@ defmodule Backpex.HTML.Resource do
 
   defp resource_actions(assigns, resource_actions) do
     Enum.filter(resource_actions, fn {key, _action} ->
-      assigns.live_resource.can?(assigns, key, nil)
+      Authorization.can?(assigns.live_resource, assigns, key, nil)
     end)
   end
 
@@ -960,7 +965,7 @@ defmodule Backpex.HTML.Resource do
     resource_actions = resource_actions(assigns, assigns.resource_actions)
 
     Enum.any?(index_actions) &&
-      (Enum.any?(resource_actions) || assigns.live_resource.can?(assigns, :new, nil))
+      (Enum.any?(resource_actions) || Authorization.can?(assigns.live_resource, assigns, :new, nil))
   end
 
   @doc """
@@ -972,11 +977,68 @@ defmodule Backpex.HTML.Resource do
     end)
   end
 
-  defp action_disabled?(assigns, action_key, items) do
-    Enum.filter(items, fn item ->
-      assigns.live_resource.can?(assigns, action_key, item)
+  # Pairs each bulk action with the reason it cannot be clicked right now, or `nil` when it can.
+  # Computed once per button so the authorization check does not run twice per action.
+  defp index_action_buttons(assigns) do
+    assigns.item_actions
+    |> filter_item_actions(:index)
+    |> Enum.map(fn {key, action} ->
+      {key, action, action_disabled_reason(assigns, key, assigns.selected_items)}
     end)
-    |> Enum.empty?()
+  end
+
+  # Enforcement is strict: a selection containing a single unauthorized item raises. So the button
+  # must be disabled unless *every* selected item is authorized. `Enum.all?([]) == true`, so the
+  # empty selection has to be handled explicitly. The reason is surfaced as a tooltip — a button
+  # that is disabled without saying why is a dead end.
+  defp action_disabled_reason(assigns, action_key, items) do
+    cond do
+      items == [] ->
+        Backpex.__("Select at least one item to use this action.", assigns.live_resource)
+
+      not Authorization.can_all?(assigns.live_resource, assigns, action_key, items) ->
+        Backpex.__("Your selection contains items you may not apply this action to.", assigns.live_resource)
+
+      true ->
+        nil
+    end
+  end
+
+  # `{item, index, selectable?}` per row, so the table computes the selectable state once instead of
+  # once per attribute that needs it.
+  defp index_rows(assigns) do
+    assigns.items
+    |> Enum.with_index()
+    |> Enum.map(fn {item, index} -> {item, index, item_selectable?(assigns, item)} end)
+  end
+
+  @doc """
+  Returns whether `item` can take part in any of the bulk (index) item actions.
+
+  A row that is authorized for none of them can never be acted on from the toolbar. Its selection
+  checkbox is therefore disabled and "select all" skips it — otherwise a user could assemble a
+  selection for which every action is disabled, with nothing saying which row caused it.
+  """
+  def item_selectable?(assigns, item) do
+    assigns.item_actions
+    |> filter_item_actions(:index)
+    |> Enum.any?(fn {key, _action} -> Authorization.can?(assigns.live_resource, assigns, key, item) end)
+  end
+
+  @doc """
+  Accessible name for a row's selection checkbox, explaining the disabled state when there is one.
+  """
+  def select_item_label(assigns, item, selectable?) do
+    id = LiveResource.primary_value(item, assigns.live_resource)
+
+    if selectable? do
+      Backpex.__({"Select item with id: %{id}", %{id: id}}, assigns.live_resource)
+    else
+      Backpex.__(
+        {"Item with id %{id} cannot be selected: no action is available for it", %{id: id}},
+        assigns.live_resource
+      )
+    end
   end
 
   @doc """
@@ -1004,7 +1066,7 @@ defmodule Backpex.HTML.Resource do
       |> assign(:search_active?, get_in(assigns, [:query_options, :search]) not in [nil, ""])
       |> assign(:filter_active?, get_in(assigns, [:query_options, :filters]) != %{})
       |> assign(:title, Backpex.__({"No %{resources} found", %{resources: plural_name}}, assigns.live_resource))
-      |> assign(:create_allowed, assigns.live_resource.can?(assigns, :new, nil))
+      |> assign(:create_allowed, Authorization.can?(assigns.live_resource, assigns, :new, nil))
 
     ~H"""
     <div class="flex justify-center py-16">
diff --git a/lib/backpex/html/resource/form_component.html.heex b/lib/backpex/html/resource/form_component.html.heex
index 53457252c..c2aeeb1bd 100644
--- a/lib/backpex/html/resource/form_component.html.heex
+++ b/lib/backpex/html/resource/form_component.html.heex
@@ -6,13 +6,6 @@
     phx-target={@myself}
     phx-change="validate"
     phx-submit="save"
-    phx-value-action-key={
-      if @action_type == :item do
-        @action_to_confirm.key
-      else
-        nil
-      end
-    }
     multipart
   >
     <.edit_card>
diff --git a/lib/backpex/html/resource/resource_index_table.html.heex b/lib/backpex/html/resource/resource_index_table.html.heex
index c2679de81..cc687e428 100644
--- a/lib/backpex/html/resource/resource_index_table.html.heex
+++ b/lib/backpex/html/resource/resource_index_table.html.heex
@@ -33,7 +33,7 @@
   </thead>
   <tbody>
     <tr
-      :for={{item, index} <- Enum.with_index(@items)}
+      :for={{item, index, selectable?} <- index_rows(assigns)}
       id={"row-item-#{LiveResource.primary_value(item, @live_resource)}"}
       class={index_row_class(assigns, item, selected?(@selected_items, item), index)}
       phx-hook="BackpexStickyActions"
@@ -47,12 +47,12 @@
           type="checkbox"
           class="checkbox checkbox-sm"
           checked={selected?(@selected_items, item)}
-          aria-label={
-            Backpex.__(
-              {"Select item with id: %{id}", %{id: LiveResource.primary_value(item, @live_resource)}},
-              @live_resource
-            )
+          disabled={not selectable?}
+          title={
+            if not selectable?,
+              do: Backpex.__("No action is available for this item.", @live_resource)
           }
+          aria-label={select_item_label(assigns, item, selectable?)}
         />
       </td>
       <td :for={{name, field_options} <- @fields} :if={active?(@active_fields, name)} class="text-base-content/75">
@@ -67,7 +67,7 @@
       ]}>
         <div class={["flex items-center justify-end space-x-2"]}>
           <%= for {key, action} <- filter_item_actions(@item_actions, :row),
-                  @live_resource.can?(assigns, key, item) do %>
+                  Authorization.can?(@live_resource, assigns, key, item) do %>
             <%= if Backpex.ItemAction.has_link?(action) do %>
               <.link
                 id={"item-action-#{key}-#{LiveResource.primary_value(item, @live_resource)}"}
diff --git a/lib/backpex/item_actions/delete.ex b/lib/backpex/item_actions/delete.ex
index e8f88421e..9f13741a2 100644
--- a/lib/backpex/item_actions/delete.ex
+++ b/lib/backpex/item_actions/delete.ex
@@ -42,9 +42,14 @@ defmodule Backpex.ItemActions.Delete do
 
   @impl Backpex.ItemAction
   def handle(socket, items, _data) do
-    {:ok, deleted_items} = Resource.delete_all(items, socket.assigns.live_resource)
+    %{live_resource: live_resource} = socket.assigns
 
-    Enum.each(deleted_items, fn deleted_item -> socket.assigns.live_resource.on_item_deleted(socket, deleted_item) end)
+    # Backpex only calls `handle/3` once `Backpex.ItemAction.authorize_fresh!/3` has re-read these
+    # items and authorized exactly them under exactly this action's key — `items` *is* that re-read
+    # list. Re-checking here would run the user's `can?/3` a second time for the same decision.
+    {:ok, deleted_items} = Resource.delete_all(items, socket.assigns, live_resource, authorize?: false)
+
+    Enum.each(deleted_items, fn deleted_item -> live_resource.on_item_deleted(socket, deleted_item) end)
 
     socket
     |> clear_flash()
diff --git a/lib/backpex/item_actions/item_action.ex b/lib/backpex/item_actions/item_action.ex
index 1a58def9e..6ada3c747 100644
--- a/lib/backpex/item_actions/item_action.ex
+++ b/lib/backpex/item_actions/item_action.ex
@@ -4,9 +4,12 @@ defmodule Backpex.ItemAction do
   """
   import Phoenix.Component
 
+  alias Backpex.Authorization
   alias Backpex.ItemActions.Delete
   alias Backpex.ItemActions.Edit
   alias Backpex.ItemActions.Show
+  alias Backpex.LiveResource
+  alias Backpex.Resource
   alias Phoenix.LiveView.Rendered
   alias Phoenix.LiveView.Socket
 
@@ -262,29 +265,141 @@ defmodule Backpex.ItemAction do
     ]
   end
 
+  @doc """
+  Resolves a client-supplied item action key and decides how the gesture proceeds.
+
+  Returns `{:confirm, key, action}` for an action that has a confirmation modal and
+  `{:dispatch, key, action}` for one that runs immediately. An unregistered key raises
+  `Backpex.NoResultsError`.
+
+  Only the `{:confirm, _key, _action}` path is authorized here, before the modal opens: an
+  unauthorized selection must not even get a confirm dialog. This is a *preflight* check on the
+  items as they are currently rendered — it only decides whether the dialog opens. The modal's
+  submit runs `authorize_fresh!/3`, which reloads the records first and is the authoritative gate,
+  so nothing is lost by not reloading here.
+
+  The `{:dispatch, _key, _action}` path is deliberately *not* authorized here — `handle_item_action/5`
+  gates it, and that is the authoritative execution gate. Checking in both places would evaluate
+  `c:Backpex.LiveResource.can?/3` twice per item for one decision.
+  """
+  def resolve_item_action!(socket, key, items) when is_list(items) do
+    {key, action} = LiveResource.fetch_action!(socket.assigns.item_actions, key)
+
+    if has_confirm_modal?(action) do
+      Authorization.authorize_all!(socket.assigns.live_resource, socket.assigns, key, items)
+
+      {:confirm, key, action}
+    else
+      {:dispatch, key, action}
+    end
+  end
+
+  @doc """
+  Re-reads `items` from the data layer and authorizes the reloaded records against `key`.
+
+  Returns the reloaded items, in the order they were given, ready to be handed to `dispatch/5`.
+
+  This is the authoritative execution gate for item actions, and both execution paths go through
+  it: `handle_item_action/5` for an action that runs immediately, and the confirmation modal's
+  submit in `Backpex.FormComponent`.
+
+  It reloads first because a selection is a snapshot. Rows are cached in `assigns.selected_items`
+  when they are selected, and a confirmation modal can stay open for as long as the user likes.
+  Authorizing the snapshot would let a record that has changed since then — a user promoted to
+  `admin`, say — be mutated under a permission it no longer has, because the write that follows
+  addresses the row by its primary key. The records handed to `c:handle/3` are therefore the ones
+  that were just authorized, not the ones that were rendered.
+
+  Failure semantics are those of `Backpex.Authorization.authorize_all!/4`: an item that no longer
+  exists, or that has left the LiveResource's `item_query/3` scope, reloads as `nil` and raises
+  `Backpex.NoResultsError`; a reloaded item that is not authorized raises `Backpex.ForbiddenError`.
+  Nothing is silently dropped from the selection.
+
+  The resource fields used for the reload are derived from `assigns.live_action`, so associations
+  are preloaded exactly as they are for the view the action was triggered from.
+
+  > #### The reload is not a lock {: .warning}
+  >
+  > A window remains between the reload and whatever `c:handle/3` writes. Backpex deliberately does
+  > not open a transaction or lock the rows here: `c:handle/3` owns the write and decides what
+  > isolation it needs. An action that requires strict atomicity has to re-read and lock inside its
+  > own `c:handle/3` — for example in an `c:Ecto.Repo.transaction/2` with a `lock: "FOR UPDATE"`
+  > query.
+  """
+  def authorize_fresh!(socket, key, items) when is_list(items) do
+    %{live_resource: live_resource, live_action: live_action} = socket.assigns
+
+    fields = LiveResource.fields(live_resource, live_action, socket.assigns)
+    fresh_items = Resource.reload(items, fields, socket.assigns, live_resource)
+
+    Authorization.authorize_all!(live_resource, socket.assigns, key, fresh_items)
+
+    fresh_items
+  end
+
   @doc """
   Handles an item action by executing the action's handle function.
 
-  This function filters items based on authorization, executes the action,
-  and allows customization of post-action behavior via the `after_handle` callback.
+  The selection is reloaded and authorized against `key` through `authorize_fresh!/3` before
+  `c:handle/3` runs, and it is the *reloaded* records that `c:handle/3` receives — see there for
+  what that guarantees and what it does not. This is strict: a single unauthorized item raises
+  `Backpex.ForbiddenError`, and an item that no longer exists (or a stale or forged item id) raises
+  `Backpex.NoResultsError`. Items are never silently dropped from the selection.
+
+  `c:handle/3` receives the full list of items, and `assigns.item_action_key` is available for the
+  duration of that call only — see `dispatch/5`. `assigns.selected_items` is updated to the same
+  reloaded records, so an action that reads it sees what it was handed.
+
+  Because this gate covered exactly these items under exactly this key, a `Backpex.Resource` call
+  inside `c:handle/3` that writes those same items should pass `authorize?: false` rather than
+  repeat the check. Writes to *other* items or resources keep the default gate.
+
+  When the selection is empty, `c:handle/3` is not called at all — only `after_handle` runs.
   """
   def handle_item_action(socket, action, key, items, after_handle) do
-    live_resource = socket.assigns.live_resource
-    authorized_items = Enum.filter(items, fn item -> live_resource.can?(socket.assigns, key, item) end)
+    items = authorize_fresh!(socket, key, items)
 
-    case action.module.handle(socket, authorized_items, %{}) do
-      {:ok, socket} ->
-        after_handle.(socket)
+    if items == [] do
+      after_handle.(socket)
+    else
+      socket = assign(socket, :selected_items, items)
 
-      unexpected_return ->
-        raise ArgumentError, """
-        Invalid return value from #{inspect(action.module)}.handle/3.
+      case dispatch(socket, action, key, items, %{}) do
+        {:ok, socket} ->
+          after_handle.(socket)
 
-        Expected: {:ok, socket}
-        Got: #{inspect(unexpected_return)}
+        unexpected_return ->
+          raise ArgumentError, """
+          Invalid return value from #{inspect(action.module)}.handle/3.
 
-        Item Actions with no form fields must return {:ok, socket}.
-        """
+          Expected: {:ok, socket}
+          Got: #{inspect(unexpected_return)}
+
+          Item Actions with no form fields must return {:ok, socket}.
+          """
+      end
+    end
+  end
+
+  @doc """
+  Calls `c:handle/3` with `assigns.item_action_key` set to `key`, and clears the assign again on the
+  socket the action returns.
+
+  The key is scoped to exactly one dispatch. Leaving it set would let a later dispatch — or any
+  component rendered afterwards — read the key of an action that already finished.
+
+  Returns whatever `c:handle/3` returned. Reloading and authorizing are the caller's job: this only
+  runs the action. Pass it the list `authorize_fresh!/3` returned, never a cached selection.
+  """
+  def dispatch(socket, action, key, items, data) do
+    result =
+      socket
+      |> assign(:item_action_key, key)
+      |> action.module.handle(items, data)
+
+    case result do
+      {:ok, socket} -> {:ok, assign(socket, :item_action_key, nil)}
+      other -> other
     end
   end
 
diff --git a/lib/backpex/live_components/form_component.ex b/lib/backpex/live_components/form_component.ex
index 9ca5410b7..d6dde3e48 100644
--- a/lib/backpex/live_components/form_component.ex
+++ b/lib/backpex/live_components/form_component.ex
@@ -5,6 +5,7 @@ defmodule Backpex.FormComponent do
   use BackpexWeb, :html
   use Phoenix.LiveComponent
 
+  alias Backpex.Authorization
   alias Backpex.Field
   alias Backpex.ItemAction
   alias Backpex.LiveResource
@@ -178,9 +179,10 @@ defmodule Backpex.FormComponent do
     |> noreply()
   end
 
-  def handle_event("save", %{"action-key" => key, "change" => change}, %{assigns: %{action_type: :item}} = socket) do
-    key = String.to_existing_atom(key)
-    handle_form_item_action(socket, key, change)
+  # The action to run is taken from `action_to_confirm`, which the view assigned when the modal was
+  # opened. A client-supplied action key must never decide which module executes.
+  def handle_event("save", %{"change" => change}, %{assigns: %{action_type: :item}} = socket) do
+    handle_form_item_action(socket, change)
   end
 
   def handle_event("save", %{"change" => change, "save-type" => save_type}, socket) do
@@ -195,9 +197,8 @@ defmodule Backpex.FormComponent do
     handle_save(socket, live_action, change, save_type)
   end
 
-  def handle_event("save", %{"action-key" => key}, socket) do
-    key = String.to_existing_atom(key)
-    handle_form_item_action(socket, key, %{})
+  def handle_event("save", _params, %{assigns: %{action_type: :item}} = socket) do
+    handle_form_item_action(socket, %{})
   end
 
   def handle_event("save", _params, socket) do
@@ -316,6 +317,10 @@ defmodule Backpex.FormComponent do
         } = assigns
     } = socket
 
+    # The gate at mount only covers opening the modal. Re-check on submit so a permission revoked
+    # while the form was open cannot be used.
+    Authorization.authorize!(live_resource, assigns, assigns.resource_action_id, nil)
+
     assocs = Map.get(assigns, :assocs, [])
     params = drop_readonly_changes(params, fields, assigns)
 
@@ -355,30 +360,50 @@ defmodule Backpex.FormComponent do
     end
   end
 
-  defp handle_form_item_action(socket, action_key, params) do
-    %{
-      assigns:
-        %{
-          live_resource: live_resource,
-          fields: fields,
-          selected_items: selected_items,
-          action_to_confirm: action_to_confirm,
-          return_to: return_to
-        } = assigns
-    } = socket
+  defp handle_form_item_action(socket, params) do
+    %{assigns: %{selected_items: selected_items, action_to_confirm: action, return_to: return_to}} = socket
+
+    action_key = action.key
+
+    # Authoritative gate, before any changeset work. The rows in `selected_items` are the snapshot
+    # taken when they were selected and the modal may have been open for a long time, so the
+    # selection is re-read from the data layer first and it is the *fresh* records that get
+    # authorized and dispatched. A permission revoked, a record changed out from under the modal,
+    # a row deleted, or the selection widened while the modal was open — all of them are caught
+    # here. See `Backpex.ItemAction.authorize_fresh!/3` for the residual window this leaves.
+    selected_items = ItemAction.authorize_fresh!(socket, action_key, selected_items)
+
+    if selected_items == [] do
+      close_item_action(socket, return_to)
+    else
+      socket
+      |> assign(:selected_items, selected_items)
+      |> run_form_item_action(action, action_key, selected_items, return_to, params)
+    end
+  end
+
+  # The selection is done with either way: whether the action ran or there was nothing to run it
+  # on, the modal closes, the selection is dropped and we return to where we came from.
+  defp close_item_action(socket, return_to) do
+    socket
+    |> assign(:show_form_errors, false)
+    |> assign(:selected_items, [])
+    |> assign(:select_all, false)
+    |> push_navigate(to: return_to)
+    |> noreply()
+  end
+
+  defp run_form_item_action(socket, action, action_key, selected_items, return_to, params) do
+    %{assigns: %{fields: fields} = assigns} = socket
 
     params = drop_readonly_changes(params, fields, assigns)
 
     result =
-      if ItemAction.has_form?(action_to_confirm) do
-        changeset_function = fn item, changes, metadata ->
-          action_to_confirm.module.changeset(item, changes, metadata)
-        end
-
+      if ItemAction.has_form?(action) do
         metadata = Resource.build_changeset_metadata(assigns)
 
         assigns.action_item
-        |> changeset_function.(params, metadata)
+        |> action.module.changeset(params, metadata)
         |> Map.put(:action, :insert)
         |> Ecto.Changeset.apply_action(:insert)
       else
@@ -386,14 +411,8 @@ defmodule Backpex.FormComponent do
       end
 
     with {:ok, data} <- result,
-         selected_items = Enum.filter(selected_items, &live_resource.can?(socket.assigns, action_key, &1)),
-         {:ok, socket} <- action_to_confirm.module.handle(socket, selected_items, data) do
-      socket
-      |> assign(:show_form_errors, false)
-      |> assign(:selected_items, [])
-      |> assign(:select_all, false)
-      |> push_navigate(to: return_to)
-      |> noreply()
+         {:ok, socket} <- ItemAction.dispatch(socket, action, action_key, selected_items, data) do
+      close_item_action(socket, return_to)
     else
       {:error, changeset} ->
         form = Component.to_form(changeset, as: :change)
@@ -405,7 +424,7 @@ defmodule Backpex.FormComponent do
 
       unexpected_return ->
         raise ArgumentError, """
-        Invalid return value from #{inspect(action_to_confirm.module)}.handle/2.
+        Invalid return value from #{inspect(action.module)}.handle/2.
 
         Expected: {:ok, socket} or {:error, changeset}
         Got: #{inspect(unexpected_return)}
diff --git a/lib/backpex/live_resource.ex b/lib/backpex/live_resource.ex
index ce8e45414..89af7f854 100644
--- a/lib/backpex/live_resource.ex
+++ b/lib/backpex/live_resource.ex
@@ -171,6 +171,26 @@ defmodule Backpex.LiveResource do
   @doc """
   The function that can be used to restrict access to certain actions. It will be called before performing
   an action and aborts when the function returns `false`.
+
+  ## Enforcement
+
+  Backpex enforces this callback centrally through `Backpex.Authorization`. It is evaluated both as a
+  preflight check (to hide or disable controls) and as a hard gate immediately before an action runs:
+
+  * `Backpex.Resource.insert/6` authorizes `:new` with a `nil` item.
+  * `Backpex.Resource.update/6` authorizes `:edit` with the item.
+  * `Backpex.Resource.delete_all/4` authorizes `:delete` per item.
+  * `Backpex.Resource.update_all/5` authorizes `:edit` per item.
+  * Item actions authorize their action key per item, resource actions authorize their key with a `nil` item.
+
+  The default action can be overridden per call with the `:authorization_action` option, and skipped
+  entirely with `authorize?: false` for system writes.
+
+  Enforcement is strict: a single unauthorized item in a selection raises `Backpex.ForbiddenError`
+  instead of silently dropping that item.
+
+  Read operations (`:index`, `:show`) are enforced in the view layer only. `Backpex.Resource.list/4`,
+  `Backpex.Resource.get/4` and `Backpex.Resource.count/4` do not call this callback.
   """
   @callback can?(assigns :: map(), action :: atom(), item :: map() | nil) :: boolean()
 
@@ -465,7 +485,7 @@ defmodule Backpex.LiveResource do
           </.main_title>
           <div class="flex items-center space-x-2">
             <%= for {key, action} <- Backpex.HTML.Resource.filter_item_actions(@item_actions, :show),
-                    @live_resource.can?(assigns, key, @item) do %>
+                    Backpex.Authorization.can?(@live_resource, assigns, key, @item) do %>
               <%= if Backpex.ItemAction.has_link?(action) do %>
                 <.link
                   id={"item-action-#{key}"}
@@ -1032,4 +1052,25 @@ defmodule Backpex.LiveResource do
   end
 
   defp safe_return_to?(_path), do: false
+
+  # Resolves a client-supplied action key (from an event payload or the URL) against a keyword list
+  # of registered item or resource actions.
+  #
+  # Returns `{key, action}` for the matching registration and raises `Backpex.NoResultsError` when
+  # the key is not registered.
+  #
+  # The key is matched by comparing binaries rather than by `String.to_existing_atom/1`: a forged
+  # key must produce the same 404 as an unknown one, not an `ArgumentError` that depends on which
+  # atoms happen to exist in the running system.
+  #
+  # This parses an HTTP event, it is not LiveResource configuration API — hence `@doc false`.
+  @doc false
+  def fetch_action!(actions, key) when is_list(actions) and is_binary(key) do
+    case Enum.find(actions, fn {registered_key, _action} -> Atom.to_string(registered_key) == key end) do
+      nil -> raise Backpex.NoResultsError
+      registration -> registration
+    end
+  end
+
+  def fetch_action!(_actions, _key), do: raise(Backpex.NoResultsError)
 end
diff --git a/lib/backpex/live_resource/form.ex b/lib/backpex/live_resource/form.ex
index 7b2465f0a..260b90e15 100644
--- a/lib/backpex/live_resource/form.ex
+++ b/lib/backpex/live_resource/form.ex
@@ -4,6 +4,7 @@ defmodule Backpex.LiveResource.Form do
 
   import Phoenix.Component
 
+  alias Backpex.Authorization
   alias Backpex.LiveResource
   alias Backpex.Resource
 
@@ -94,13 +95,13 @@ defmodule Backpex.LiveResource.Form do
   end
 
   defp can?(socket, live_resource, :new = live_action) do
-    if not live_resource.can?(socket.assigns, live_action, nil), do: raise(Backpex.ForbiddenError)
+    Authorization.authorize!(live_resource, socket.assigns, live_action, nil)
 
     socket
   end
 
   defp can?(socket, live_resource, :edit = live_action) do
-    if not live_resource.can?(socket.assigns, live_action, socket.assigns.item), do: raise(Backpex.ForbiddenError)
+    Authorization.authorize!(live_resource, socket.assigns, live_action, socket.assigns.item)
 
     socket
   end
diff --git a/lib/backpex/live_resource/index.ex b/lib/backpex/live_resource/index.ex
index f44c4597e..d8c6dcf7a 100644
--- a/lib/backpex/live_resource/index.ex
+++ b/lib/backpex/live_resource/index.ex
@@ -5,7 +5,9 @@ defmodule Backpex.LiveResource.Index do
   import Phoenix.Component
 
   alias Backpex.Adapters.Ecto, as: EctoAdapter
+  alias Backpex.Authorization
   alias Backpex.FilterValidation
+  alias Backpex.ItemAction
   alias Backpex.LiveResource
   alias Backpex.PaginationValidation
   alias Backpex.Preferences
@@ -75,15 +77,18 @@ defmodule Backpex.LiveResource.Index do
 
     primary_value = LiveResource.primary_value(item, live_resource)
 
-    case find_item_by_primary_value(items, primary_value, live_resource) do
-      nil ->
-        noreply(socket)
+    socket =
+      case find_item_by_primary_value(items, primary_value, live_resource) do
+        nil -> socket
+        _item -> refresh_items(socket)
+      end
 
-      _item ->
-        socket
-        |> refresh_items()
-        |> noreply()
-    end
+    # Drop the row from the selection whether or not it was on this page: a deleted item left in
+    # `selected_items` inflates the confirm dialog's count and then raises `Backpex.NoResultsError`
+    # at the execution gate.
+    socket
+    |> drop_selected_item(primary_value)
+    |> noreply()
   end
 
   # credo:disable-for-this-file Credo.Check.Design.DuplicatedCode
@@ -132,7 +137,9 @@ defmodule Backpex.LiveResource.Index do
   def handle_event("item-action", %{"action-key" => key, "item-id" => item_id}, socket) do
     %{items: items, live_resource: live_resource} = socket.assigns
 
-    item = find_item_by_primary_value(items, item_id, live_resource)
+    # A stale or forged id must never enter the selection: `nil` would reach the user's `can?/3`
+    # during render. 404 also keeps the event from confirming whether an id exists.
+    item = find_item_by_primary_value(items, item_id, live_resource) || raise(Backpex.NoResultsError)
 
     socket
     |> assign(selected_items: [item])
@@ -200,29 +207,40 @@ defmodule Backpex.LiveResource.Index do
   def handle_event("update-selected-items", %{"id" => id}, socket) do
     %{selected_items: selected_items, live_resource: live_resource, items: items} = socket.assigns
 
-    item = find_item_by_primary_value(items, id, live_resource)
+    # `id` is client-controlled. A tampered or stale id must be a no-op rather than putting `nil`
+    # into the selection, where it would reach the user's `can?/3` on the next render.
+    case find_item_by_primary_value(items, id, live_resource) do
+      nil ->
+        noreply(socket)
 
-    updated_selected_items =
-      if Enum.member?(selected_items, item) do
-        List.delete(selected_items, item)
-      else
-        [item | selected_items]
-      end
+      item ->
+        updated_selected_items =
+          if Enum.member?(selected_items, item) do
+            List.delete(selected_items, item)
+          else
+            [item | selected_items]
+          end
 
-    select_all = length(updated_selected_items) == length(items)
+        # Rows the user may not act on at all are not selectable, so "everything is selected" means
+        # every *selectable* row — not every row on the page.
+        select_all =
+          updated_selected_items != [] and
+            length(updated_selected_items) == length(selectable_items(socket.assigns))
 
-    socket
-    |> assign(:selected_items, updated_selected_items)
-    |> assign(:select_all, select_all)
-    |> noreply()
+        socket
+        |> assign(:selected_items, updated_selected_items)
+        |> assign(:select_all, select_all)
+        |> noreply()
+    end
   end
 
   def handle_event("toggle-item-selection", _params, socket) do
-    select_all = not socket.assigns.select_all
-    selected_items = (select_all && socket.assigns.items) || []
+    # Selecting a row the user may not act on would only produce a selection whose every bulk
+    # action is disabled, so select-all skips those rows.
+    selected_items = if socket.assigns.select_all, do: [], else: selectable_items(socket.assigns)
 
     socket
-    |> assign(:select_all, select_all)
+    |> assign(:select_all, selected_items != [])
     |> assign(:selected_items, selected_items)
     |> noreply()
   end
@@ -291,26 +309,23 @@ defmodule Backpex.LiveResource.Index do
   end
 
   defp maybe_handle_item_action(socket, key) do
-    key = String.to_existing_atom(key)
-    action = socket.assigns.item_actions[key]
     items = socket.assigns.selected_items
 
-    if Backpex.ItemAction.has_confirm_modal?(action) do
-      open_action_confirm_modal(socket, action, key)
-    else
-      handle_item_action(socket, action, key, items)
+    case ItemAction.resolve_item_action!(socket, key, items) do
+      {:confirm, key, action} -> open_action_confirm_modal(socket, action, key)
+      {:dispatch, key, action} -> handle_item_action(socket, action, key, items)
     end
   end
 
   defp open_action_confirm_modal(socket, action, key) do
     socket
-    |> Backpex.ItemAction.assign_action_changeset(action)
+    |> ItemAction.assign_action_changeset(action)
     |> assign(:action_to_confirm, Map.put(action, :key, key))
     |> noreply()
   end
 
   defp handle_item_action(socket, action, key, items) do
-    Backpex.ItemAction.handle_item_action(socket, action, key, items, fn socket ->
+    ItemAction.handle_item_action(socket, action, key, items, fn socket ->
       socket
       |> assign(action_to_confirm: nil)
       |> assign(selected_items: [])
@@ -319,6 +334,10 @@ defmodule Backpex.LiveResource.Index do
     end)
   end
 
+  defp selectable_items(assigns) do
+    Enum.filter(assigns.items, &Backpex.HTML.Resource.item_selectable?(assigns, &1))
+  end
+
   defp find_item_by_primary_value(items, primary_value, live_resource) do
     Enum.find(items, fn item ->
       to_string(LiveResource.primary_value(item, live_resource)) == to_string(primary_value)
@@ -436,23 +455,60 @@ defmodule Backpex.LiveResource.Index do
     end
   end
 
+  # The selection caches whole records, so a row that changed elsewhere has to be replaced there
+  # too — otherwise the confirm dialog and every preflight `can?/3` keep describing the old values.
+  # This is a UI nicety only: `Backpex.ItemAction.authorize_fresh!/3` re-reads the selection before
+  # the execution gate either way.
   defp update_item(socket, item) do
-    %{live_resource: live_resource, fields: fields, items: items} = socket.assigns
+    %{live_resource: live_resource, fields: fields} = socket.assigns
 
     primary_value = LiveResource.primary_value(item, live_resource)
+
+    case Resource.get(primary_value, fields, socket.assigns, live_resource) do
+      {:ok, nil} ->
+        # The row left the item query's scope between the broadcast and this read. Treat it like a
+        # deletion rather than putting `nil` into `items` or `selected_items`, where it would reach
+        # the user's `can?/3` on the next render.
+        socket
+        |> refresh_items()
+        |> drop_selected_item(primary_value)
+
+      {:ok, updated_item} ->
+        replace = fn list -> replace_item(list, primary_value, updated_item, live_resource) end
+
+        socket
+        |> assign(:items, replace.(socket.assigns.items))
+        |> assign(:selected_items, replace.(socket.assigns.selected_items))
+    end
+  end
+
+  defp replace_item(list, primary_value, updated_item, live_resource) do
     primary_value_str = to_string(primary_value)
-    {:ok, updated_item} = Resource.get(primary_value, fields, socket.assigns, live_resource)
-
-    updated_items =
-      Enum.map(items, fn current_item ->
-        if to_string(LiveResource.primary_value(current_item, live_resource)) == primary_value_str do
-          updated_item
-        else
-          current_item
-        end
+
+    Enum.map(list, fn current_item ->
+      if to_string(LiveResource.primary_value(current_item, live_resource)) == primary_value_str do
+        updated_item
+      else
+        current_item
+      end
+    end)
+  end
+
+  # Drops a vanished row from the selection and keeps `select_all` in step with it, so the toolbar
+  # does not claim everything is selected once the selection shrank.
+  defp drop_selected_item(socket, primary_value) do
+    %{selected_items: selected_items, live_resource: live_resource} = socket.assigns
+
+    primary_value_str = to_string(primary_value)
+
+    remaining =
+      Enum.reject(selected_items, fn item ->
+        to_string(LiveResource.primary_value(item, live_resource)) == primary_value_str
       end)
 
-    assign(socket, :items, updated_items)
+    socket
+    |> assign(:selected_items, remaining)
+    |> assign(:select_all, remaining != [] and length(remaining) == length(selectable_items(socket.assigns)))
   end
 
   defp assign_metrics_visibility(socket, ctx) do
@@ -476,7 +532,7 @@ defmodule Backpex.LiveResource.Index do
   end
 
   defp assign_item_actions(socket) do
-    item_actions = Backpex.ItemAction.default_actions() |> socket.assigns.live_resource.item_actions()
+    item_actions = ItemAction.default_actions() |> socket.assigns.live_resource.item_actions()
     assign(socket, :item_actions, item_actions)
   end
 
@@ -489,14 +545,12 @@ defmodule Backpex.LiveResource.Index do
   defp apply_action(socket, :resource_action) do
     %{live_resource: live_resource} = socket.assigns
 
-    id =
-      socket.assigns.params["backpex_id"]
-      |> URI.decode()
-      |> String.to_existing_atom()
-
-    action = live_resource.resource_actions()[id]
+    # The id comes from the URL: resolve it against the registered resource actions instead of
+    # atomizing it, so an unknown action is a 404 rather than an ArgumentError.
+    {id, action} =
+      LiveResource.fetch_action!(live_resource.resource_actions(), URI.decode(socket.assigns.params["backpex_id"]))
 
-    if not live_resource.can?(socket.assigns, id, nil), do: raise(Backpex.ForbiddenError)
+    Authorization.authorize!(live_resource, socket.assigns, id, nil)
 
     changeset_function = fn item, changes, metadata -> action.module.changeset(item, changes, metadata) end
     item = action.module.base_schema(socket.assigns)
@@ -514,7 +568,7 @@ defmodule Backpex.LiveResource.Index do
     %{live_resource: live_resource, params: params, fields: fields} = socket.assigns
     persisted = socket.assigns[:backpex_persisted_index_state] || %{order: nil, filters: nil}
 
-    if not live_resource.can?(socket.assigns, :index, nil), do: raise(Backpex.ForbiddenError)
+    Authorization.authorize!(live_resource, socket.assigns, :index, nil)
 
     per_page_options = live_resource.config(:per_page_options)
     per_page_default = live_resource.config(:per_page_default)
diff --git a/lib/backpex/live_resource/show.ex b/lib/backpex/live_resource/show.ex
index 0edb223d8..229390aaf 100644
--- a/lib/backpex/live_resource/show.ex
+++ b/lib/backpex/live_resource/show.ex
@@ -4,6 +4,8 @@ defmodule Backpex.LiveResource.Show do
 
   import Phoenix.Component
 
+  alias Backpex.Authorization
+  alias Backpex.ItemAction
   alias Backpex.Resource
   alias Backpex.Router
 
@@ -61,7 +63,7 @@ defmodule Backpex.LiveResource.Show do
     primary_value = URI.decode(backpex_id)
     item = Resource.get!(primary_value, fields, socket.assigns, live_resource)
 
-    if not live_resource.can?(socket.assigns, :show, item), do: raise(Backpex.ForbiddenError)
+    Authorization.authorize!(live_resource, socket.assigns, :show, item)
 
     socket
     |> assign(:item, item)
@@ -69,19 +71,16 @@ defmodule Backpex.LiveResource.Show do
   end
 
   defp assign_item_actions(socket) do
-    item_actions = Backpex.ItemAction.default_actions() |> socket.assigns.live_resource.item_actions()
+    item_actions = ItemAction.default_actions() |> socket.assigns.live_resource.item_actions()
     assign(socket, :item_actions, item_actions)
   end
 
   defp maybe_handle_item_action(socket, key) do
-    key = String.to_existing_atom(key)
-    action = socket.assigns.item_actions[key]
     item = socket.assigns.item
 
-    if Backpex.ItemAction.has_confirm_modal?(action) do
-      open_action_confirm_modal(socket, action, key)
-    else
-      handle_item_action(socket, action, key, item)
+    case ItemAction.resolve_item_action!(socket, key, [item]) do
+      {:confirm, key, action} -> open_action_confirm_modal(socket, action, key)
+      {:dispatch, key, action} -> handle_item_action(socket, action, key, item)
     end
   end
 
@@ -91,7 +90,7 @@ defmodule Backpex.LiveResource.Show do
 
     socket
     |> assign(:selected_items, [item])
-    |> Backpex.ItemAction.assign_action_changeset(action)
+    |> ItemAction.assign_action_changeset(action)
     |> assign(:return_to, return_to(socket, index_path))
     |> assign(:action_to_confirm, Map.put(action, :key, key))
     |> noreply()
@@ -101,7 +100,7 @@ defmodule Backpex.LiveResource.Show do
     %{live_resource: live_resource, params: params} = socket.assigns
     index_path = Router.get_path(socket, live_resource, params, :index)
 
-    Backpex.ItemAction.handle_item_action(socket, action, key, [item], fn socket ->
+    ItemAction.handle_item_action(socket, action, key, [item], fn socket ->
       socket
       |> assign(action_to_confirm: nil)
       |> maybe_navigate(return_to(socket, index_path))
diff --git a/lib/backpex/resource.ex b/lib/backpex/resource.ex
index 5c1a4c92c..c16980da4 100644
--- a/lib/backpex/resource.ex
+++ b/lib/backpex/resource.ex
@@ -6,8 +6,44 @@ defmodule Backpex.Resource do
   >
   > This module is still under heavy development and will change as we progress with the `Backpex.Adapter`
   > implementation in the coming releases. Keep this in mind when using this module directly.
+
+  ## Authorization
+
+  All mutations in this module are authorized through `Backpex.Authorization` before anything else
+  happens — before the changeset is built and before `c:Backpex.Field.before_changeset/6` runs. An
+  unauthorized call raises `Backpex.ForbiddenError` and never reaches the adapter.
+
+  Each mutation has a default authorization action:
+
+  | function | action | item passed to `c:Backpex.LiveResource.can?/3` |
+  | --- | --- | --- |
+  | `insert/6` | `:new` | `nil` |
+  | `update/6` | `:edit` | the item |
+  | `update_all/5` | `:edit` | each item |
+  | `delete_all/4` | `:delete` | each item |
+
+  Two options control this on every mutation:
+
+  * `:authorization_action` (atom) — authorize against this action instead of the default. It must
+    be a non-nil atom; anything else raises `ArgumentError` rather than being handed to a
+    permissive catch-all `can?/3` clause.
+  * `:authorize?` (boolean, default `true`) — set to `false` to skip the check entirely. This is the
+    escape hatch for system or cascade writes that are not a user-initiated action on that resource,
+    for example nullifying foreign keys on another resource.
+
+  Both options are consumed here and never reach `change/6`.
+
+  For lists (`update_all/5`, `delete_all/4`) the check is strict: a single unauthorized item makes
+  the whole call raise. A `nil` entry (a stale or forged item id) raises `Backpex.NoResultsError`.
+  An empty list passes without calling the adapter's authorization.
+
+  Reads (`list/4`, `get/4`, `get!/4`, `count/4`) are **not** authorized here. `:index` and `:show`
+  remain enforced in the view layer — filtering rows after pagination would corrupt counts and
+  select-all.
   """
 
+  alias Backpex.Authorization
+
   @doc """
   Returns a list of items by given criteria.
 
@@ -63,16 +99,63 @@ defmodule Backpex.Resource do
     end
   end
 
+  @doc """
+  Re-reads a list of items from the data layer, keeping the order of the given list.
+
+  Each item is fetched by its primary value through `get/4`, so the LiveResource's
+  [`item_query/3`](item-query.html) applies. An item that no longer exists — or that has left the
+  query's scope — comes back as `nil` instead of being dropped, which keeps the result positionally
+  aligned with the input and lets `Backpex.Authorization.authorize_all!/4` turn it into a
+  `Backpex.NoResultsError`. A `nil` in the input stays `nil`.
+
+  This is what makes the item action execution gates authorize the *current* record rather than the
+  snapshot that was cached when the row was selected. See `Backpex.ItemAction.authorize_fresh!/3`.
+
+  Like every other read in this module, this is **not** authorized.
+
+  ## Parameters
+
+  * `items` (list): The items to re-read.
+  * `fields` (list): The **resource** fields — they decide which associations are preloaded. Do not
+    pass an item action's form fields here.
+  * `assigns` (map): The current assigns of the socket.
+  * `live_resource` (module): The `Backpex.LiveResource` module.
+  """
+  def reload(items, fields, assigns, live_resource) when is_list(items) do
+    Enum.map(items, fn
+      nil ->
+        nil
+
+      item ->
+        primary_value = Backpex.LiveResource.primary_value(item, live_resource)
+
+        case get(primary_value, fields, assigns, live_resource) do
+          {:ok, reloaded_item} -> reloaded_item
+          {:error, _error} -> nil
+        end
+    end)
+  end
+
   @doc """
   Deletes multiple items.
   Additionally broadcasts the corresponding event for each deleted item.
 
+  Authorizes `:delete` for every item before touching the adapter. See the "Authorization" section
+  in the module documentation.
+
   ## Parameters
 
   * `items` (list): A list of structs, each representing an entity to be deleted. The list must contain items that have an `id` field.
+  * `assigns` (map): The current assigns of the socket. Passed to `c:Backpex.LiveResource.can?/3`.
   * `live_resource` (module): The `Backpex.LiveResource` module.
+  * `opts` (keyword list): A list of options:
+    * `:authorization_action` (optional, default `:delete`): The action to authorize against.
+    * `:authorize?` (optional, default `true`): Set to `false` to skip authorization.
   """
-  def delete_all(items, live_resource) do
+  def delete_all(items, assigns, live_resource, opts \\ [])
+      when is_list(items) and is_map(assigns) and not is_struct(assigns) and is_atom(live_resource) do
+    _opts = authorize_items!(items, assigns, live_resource, opts, :delete)
+
     adapter = live_resource.config(:adapter)
 
     adapter.delete_all(items, live_resource)
@@ -86,26 +169,50 @@ defmodule Backpex.Resource do
   @doc """
   Inserts a new item into a repository with specific parameters and options. It takes a repo module, a changeset function, an item, parameters for the changeset function, and additional options.
 
+  Authorizes `:new` with a `nil` item before the changeset is built. See the "Authorization" section
+  in the module documentation.
+
   ## Parameters
 
   * `item` (struct): The Ecto schema struct.
   * `attrs` (map): A map of parameters that will be passed to the `changeset_function`.
-  * TODO: docs
+  * `fields` (list): The fields for this insert.
+  * `assigns` (map): The current assigns of the socket. Passed to `c:Backpex.LiveResource.can?/3` and to the changeset function.
+  * `live_resource` (module): The `Backpex.LiveResource` module.
+  * `opts` (keyword list): A list of options:
+    * `:authorization_action` (optional, default `:new`): The action to authorize against.
+    * `:authorize?` (optional, default `true`): Set to `false` to skip authorization.
+    * `:after_save_fun` (optional): A function called with the inserted item, returning `{:ok, item}`.
+    * All remaining options are passed to `change/6`.
   """
-  def insert(item, attrs, fields, assigns, live_resource, opts) do
+  def insert(item, attrs, fields, assigns, live_resource, opts \\ []) do
+    opts = authorize_item!(nil, assigns, live_resource, opts, :new)
+
     persist_item(item, attrs, fields, assigns, live_resource, opts, :insert, "created")
   end
 
   @doc """
   Handles the update of an existing item with specific parameters and options. It takes a repo module, a changeset function, an item, parameters for the changeset function, and additional options.
 
+  Authorizes `:edit` with the given item before the changeset is built. See the "Authorization"
+  section in the module documentation.
+
   ## Parameters
 
   * `item` (struct): The Ecto schema struct.
   * `attrs` (map): A map of parameters that will be passed to the `changeset_function`.
-  * TODO: docs
+  * `fields` (list): The fields for this update.
+  * `assigns` (map): The current assigns of the socket. Passed to `c:Backpex.LiveResource.can?/3` and to the changeset function.
+  * `live_resource` (module): The `Backpex.LiveResource` module.
+  * `opts` (keyword list): A list of options:
+    * `:authorization_action` (optional, default `:edit`): The action to authorize against.
+    * `:authorize?` (optional, default `true`): Set to `false` to skip authorization.
+    * `:after_save_fun` (optional): A function called with the updated item, returning `{:ok, item}`.
+    * All remaining options are passed to `change/6`.
   """
   def update(item, attrs, fields, assigns, live_resource, opts \\ []) do
+    opts = authorize_item!(item, assigns, live_resource, opts, :edit)
+
     persist_item(item, attrs, fields, assigns, live_resource, opts, :update, "updated")
   end
 
@@ -127,14 +234,25 @@ defmodule Backpex.Resource do
   Updates multiple items from a given repository and schema.
   Additionally broadcasts the corresponding event, when PubSub config is given.
 
+  Authorizes `:edit` for every item before touching the adapter. See the "Authorization" section in
+  the module documentation.
+
   ## Parameters
 
   * `items` (list): A list of structs, each representing an entity to be updated.
   * `updates` (list): A list of updates passed to Ecto `update_all` function.
-  * `event_name` (string, default: `updated`): The name to be used when broadcasting the event.
+  * `assigns` (map): The current assigns of the socket. Passed to `c:Backpex.LiveResource.can?/3`.
   * `live_resource` (module): The `Backpex.LiveResource` module.
+  * `opts` (keyword list): A list of options:
+    * `:event_name` (optional, default `"updated"`): The name to be used when broadcasting the event.
+    * `:authorization_action` (optional, default `:edit`): The action to authorize against.
+    * `:authorize?` (optional, default `true`): Set to `false` to skip authorization.
   """
-  def update_all(items, updates, event_name \\ "updated", live_resource) do
+  def update_all(items, updates, assigns, live_resource, opts \\ [])
+      when is_list(items) and is_map(assigns) and not is_struct(assigns) and is_atom(live_resource) do
+    opts = authorize_items!(items, assigns, live_resource, opts, :edit)
+
+    event_name = Keyword.get(opts, :event_name, "updated")
     adapter = live_resource.config(:adapter)
 
     case adapter.update_all(items, updates, live_resource) do
@@ -147,6 +265,44 @@ defmodule Backpex.Resource do
     end
   end
 
+  # Pops the authorization options and runs the gate for a single item. Returns the remaining opts,
+  # so `:authorization_action` and `:authorize?` never reach `change/6`.
+  defp authorize_item!(item, assigns, live_resource, opts, default_action) do
+    {authorize?, authorization_action, opts} = pop_authorization_opts(opts, default_action)
+
+    if authorize?, do: Authorization.authorize!(live_resource, assigns, authorization_action, item)
+
+    opts
+  end
+
+  # Same as `authorize_item!/5`, but strict over a list of items.
+  defp authorize_items!(items, assigns, live_resource, opts, default_action) do
+    {authorize?, authorization_action, opts} = pop_authorization_opts(opts, default_action)
+
+    if authorize?, do: Authorization.authorize_all!(live_resource, assigns, authorization_action, items)
+
+    opts
+  end
+
+  defp pop_authorization_opts(opts, default_action) do
+    {authorize?, opts} = Keyword.pop(opts, :authorize?, true)
+    {authorization_action, opts} = Keyword.pop(opts, :authorization_action, default_action)
+
+    if !is_boolean(authorize?) do
+      raise ArgumentError, "expected :authorize? to be a boolean, got: #{inspect(authorize?)}"
+    end
+
+    # `Keyword.pop/3` returns an explicitly passed `nil` rather than the default, and `nil` is an
+    # atom — so an unvalidated `authorization_action: nil` would reach `can?(assigns, nil, item)`,
+    # where a permissive catch-all clause silently authorizes the mutation. Refuse it here.
+    if is_nil(authorization_action) or not is_atom(authorization_action) do
+      raise ArgumentError,
+            "expected :authorization_action to be a non-nil atom, got: #{inspect(authorization_action)}"
+    end
+
+    {authorize?, authorization_action, opts}
+  end
+
   @doc """
   Applies a change to a given item by calling the specified changeset function.
   In addition, puts the given assocs into the function and calls the `c:Backpex.Field.before_changeset/6` callback for each field.
diff --git a/mix.exs b/mix.exs
index 8996e0144..a24736c0d 100644
--- a/mix.exs
+++ b/mix.exs
@@ -198,6 +198,7 @@ defmodule Backpex.MixProject do
       "guides/translations/translations.md",
 
       # Upgrade Guides
+      "guides/upgrading/v0.21.md",
       "guides/upgrading/v0.20.md",
       "guides/upgrading/v0.19.md",
       "guides/upgrading/v0.18.md",
diff --git a/priv/gettext/backpex.pot b/priv/gettext/backpex.pot
index c40dca6a9..909a3c8ec 100644
--- a/priv/gettext/backpex.pot
+++ b/priv/gettext/backpex.pot
@@ -123,6 +123,10 @@ msgstr ""
 msgid "Hang in there while we get back on track..."
 msgstr ""
 
+#, elixir-autogen, elixir-format
+msgid "Item with id %{id} cannot be selected: no action is available for it"
+msgstr ""
+
 #, elixir-autogen, elixir-format
 msgid "Items %{from} to %{to}"
 msgstr ""
@@ -151,6 +155,10 @@ msgstr ""
 msgid "No %{resources} found"
 msgstr ""
 
+#, elixir-autogen, elixir-format
+msgid "No action is available for this item."
+msgstr ""
+
 #, elixir-autogen, elixir-format
 msgid "No options found"
 msgstr ""
@@ -183,6 +191,10 @@ msgstr ""
 msgid "Select all items"
 msgstr ""
 
+#, elixir-autogen, elixir-format
+msgid "Select at least one item to use this action."
+msgstr ""
+
 #, elixir-autogen, elixir-format
 msgid "Select item with id: %{id}"
 msgstr ""
@@ -266,3 +278,7 @@ msgstr ""
 #, elixir-autogen, elixir-format
 msgid "We can't find the internet!"
 msgstr ""
+
+#, elixir-autogen, elixir-format
+msgid "Your selection contains items you may not apply this action to."
+msgstr ""
diff --git a/test/backpex/authorization_test.exs b/test/backpex/authorization_test.exs
new file mode 100644
index 000000000..cfc9a5ca6
--- /dev/null
+++ b/test/backpex/authorization_test.exs
@@ -0,0 +1,101 @@
+defmodule Backpex.AuthorizationTest do
+  use ExUnit.Case, async: true
+
+  alias Backpex.Authorization
+  alias Backpex.Test.LiveResources.AllowAll
+  alias Backpex.Test.LiveResources.DenyAll
+  alias Backpex.Test.LiveResources.KeyAware
+  alias Backpex.Test.LiveResources.Recording
+  alias Phoenix.LiveView.Socket
+
+  @assigns %{live_resource: AllowAll}
+
+  describe "can?/4" do
+    test "delegates to the live resource" do
+      assert Authorization.can?(AllowAll, @assigns, :new, nil)
+      refute Authorization.can?(DenyAll, @assigns, :new, nil)
+    end
+
+    test "passes action and item through untouched" do
+      item = %{id: 1}
+
+      assert Authorization.can?(Recording, @assigns, :edit, item)
+      assert_received {:can?, :edit, ^item}
+    end
+
+    test "supports a nil item" do
+      refute Authorization.can?(KeyAware, @assigns, :new, nil)
+      assert Authorization.can?(KeyAware, @assigns, :edit, nil)
+    end
+
+    test "refuses a socket where assigns are expected" do
+      # Authorizing against a `%Phoenix.LiveView.Socket{}` would answer for the wrong context. The
+      # guard has to reject it loudly instead of handing the struct to `can?/3`.
+      args = [AllowAll, %Socket{}, :new, nil]
+
+      assert_raise FunctionClauseError, fn ->
+        apply(Authorization, :can?, args)
+      end
+    end
+  end
+
+  describe "can_all?/4" do
+    test "returns true when every item is authorized" do
+      assert Authorization.can_all?(KeyAware, @assigns, :delete, [%{role: :user}, %{role: :user}])
+    end
+
+    test "returns false when a single item is unauthorized" do
+      refute Authorization.can_all?(KeyAware, @assigns, :delete, [%{role: :user}, %{role: :admin}])
+    end
+
+    test "returns true for an empty list" do
+      assert Authorization.can_all?(DenyAll, @assigns, :delete, [])
+    end
+  end
+
+  describe "authorize!/4" do
+    test "returns :ok when authorized" do
+      assert :ok = Authorization.authorize!(AllowAll, @assigns, :new, nil)
+    end
+
+    test "raises ForbiddenError when not authorized" do
+      assert_raise Backpex.ForbiddenError, fn ->
+        Authorization.authorize!(DenyAll, @assigns, :new, nil)
+      end
+    end
+
+    test "does not treat a nil item as a missing record" do
+      assert :ok = Authorization.authorize!(AllowAll, @assigns, :new, nil)
+    end
+  end
+
+  describe "authorize_all!/4" do
+    test "returns :ok when every item is authorized" do
+      assert :ok = Authorization.authorize_all!(KeyAware, @assigns, :delete, [%{role: :user}])
+    end
+
+    test "raises ForbiddenError when a single item is unauthorized" do
+      assert_raise Backpex.ForbiddenError, fn ->
+        Authorization.authorize_all!(KeyAware, @assigns, :delete, [%{role: :user}, %{role: :admin}])
+      end
+    end
+
+    test "raises NoResultsError when the list contains nil" do
+      assert_raise Backpex.NoResultsError, fn ->
+        Authorization.authorize_all!(AllowAll, @assigns, :delete, [%{role: :user}, nil])
+      end
+    end
+
+    test "never passes nil to the live resource" do
+      assert_raise Backpex.NoResultsError, fn ->
+        Authorization.authorize_all!(Recording, @assigns, :delete, [nil])
+      end
+
+      refute_received {:can?, :delete, nil}
+    end
+
+    test "returns :ok for an empty list" do
+      assert :ok = Authorization.authorize_all!(DenyAll, @assigns, :delete, [])
+    end
+  end
+end
diff --git a/test/backpex/item_action_test.exs b/test/backpex/item_action_test.exs
new file mode 100644
index 000000000..668ee54ab
--- /dev/null
+++ b/test/backpex/item_action_test.exs
@@ -0,0 +1,194 @@
+defmodule Backpex.ItemActionTest do
+  use ExUnit.Case, async: true
+
+  alias Backpex.ItemAction
+  alias Backpex.Test.LiveResources.AllowAll
+  alias Backpex.Test.LiveResources.NoAdmins
+  alias Phoenix.LiveView.Socket
+
+  defmodule EchoAction do
+    @moduledoc false
+    def handle(socket, items, _data) do
+      send(self(), {:handled, items, Map.get(socket.assigns, :item_action_key)})
+      send(self(), {:handled_selection, Map.get(socket.assigns, :selected_items)})
+
+      {:ok, socket}
+    end
+  end
+
+  defmodule BadReturnAction do
+    @moduledoc false
+    def handle(_socket, _items, _data), do: :oops
+  end
+
+  # `stub_records` is the fake data layer `Backpex.Test.StubAdapter.get/4` reads. Tests hand the
+  # gate a store that differs from the selection to simulate another actor changing (or deleting) a
+  # row while it sat in `selected_items`.
+  defp build_socket(live_resource, records \\ []) do
+    %Socket{}
+    |> Phoenix.Component.assign(:live_resource, live_resource)
+    |> Phoenix.Component.assign(:live_action, :index)
+    |> Phoenix.Component.assign(:stub_records, Map.new(records, &{&1.id, &1}))
+  end
+
+  defp after_handle(socket), do: {:after_handle, socket}
+
+  describe "authorize_fresh!/3" do
+    test "returns the records as they are now, in the order they were given" do
+      fresh = [%{id: 1, role: :user, name: "renamed"}, %{id: 2, role: :user}]
+      socket = build_socket(AllowAll, fresh)
+
+      stale = [%{id: 1, role: :user, name: "old"}, %{id: 2, role: :user}]
+
+      assert ItemAction.authorize_fresh!(socket, :user_soft_delete, stale) == fresh
+    end
+
+    test "authorizes the reloaded record, not the selected snapshot" do
+      # The row was `role: :user` when it was selected and is `role: :admin` now. `NoAdmins` denies
+      # the current one, and that is the answer that has to win.
+      socket = build_socket(NoAdmins, [%{id: 1, role: :admin}])
+
+      assert_raise Backpex.ForbiddenError, fn ->
+        ItemAction.authorize_fresh!(socket, :user_soft_delete, [%{id: 1, role: :user}])
+      end
+    end
+
+    test "lets a record that became authorized through" do
+      # The mirror image: denied when it was rendered, allowed now.
+      socket = build_socket(NoAdmins, [%{id: 1, role: :user}])
+
+      assert ItemAction.authorize_fresh!(socket, :user_soft_delete, [%{id: 1, role: :admin}]) == [%{id: 1, role: :user}]
+    end
+
+    test "raises NoResultsError when a selected row has vanished" do
+      socket = build_socket(AllowAll, [%{id: 2, role: :user}])
+
+      assert_raise Backpex.NoResultsError, fn ->
+        ItemAction.authorize_fresh!(socket, :user_soft_delete, [%{id: 1, role: :user}, %{id: 2, role: :user}])
+      end
+    end
+
+    test "reads nothing for an empty selection" do
+      socket = build_socket(AllowAll)
+
+      assert ItemAction.authorize_fresh!(socket, :user_soft_delete, []) == []
+
+      refute_received {:adapter, :get, _primary_value}
+    end
+  end
+
+  describe "handle_item_action/5" do
+    test "passes the full list to handle/3 and assigns item_action_key" do
+      items = [%{id: 1, role: :user}, %{id: 2, role: :user}]
+      socket = build_socket(AllowAll, items)
+
+      assert {:after_handle, _socket} =
+               ItemAction.handle_item_action(socket, %{module: EchoAction}, :user_soft_delete, items, &after_handle/1)
+
+      assert_received {:handled, ^items, :user_soft_delete}
+    end
+
+    test "dispatches the reloaded records rather than the selected snapshot" do
+      fresh = [%{id: 1, role: :user, name: "renamed"}]
+      stale = [%{id: 1, role: :user, name: "old"}]
+      socket = build_socket(AllowAll, fresh)
+
+      assert {:after_handle, _socket} =
+               ItemAction.handle_item_action(socket, %{module: EchoAction}, :user_soft_delete, stale, &after_handle/1)
+
+      assert_received {:handled, ^fresh, :user_soft_delete}
+    end
+
+    test "puts the reloaded records into selected_items so handle/3 sees one selection" do
+      fresh = [%{id: 1, role: :user, name: "renamed"}]
+      socket = build_socket(AllowAll, fresh)
+
+      assert {:after_handle, _socket} =
+               ItemAction.handle_item_action(
+                 socket,
+                 %{module: EchoAction},
+                 :user_soft_delete,
+                 [%{id: 1, role: :user, name: "old"}],
+                 &after_handle/1
+               )
+
+      assert_received {:handled_selection, ^fresh}
+    end
+
+    test "clears item_action_key once the dispatch is over" do
+      socket = build_socket(AllowAll, [%{id: 1}])
+
+      # The key belongs to one dispatch. Leaving it set would let a later dispatch, or anything
+      # rendered afterwards, read the key of an action that already finished.
+      assert {:after_handle, socket} =
+               ItemAction.handle_item_action(
+                 socket,
+                 %{module: EchoAction},
+                 :user_soft_delete,
+                 [%{id: 1}],
+                 &after_handle/1
+               )
+
+      assert socket.assigns.item_action_key == nil
+    end
+
+    test "raises ForbiddenError when a single item is unauthorized and never calls handle/3" do
+      items = [%{id: 1, role: :user}, %{id: 2, role: :admin}]
+      socket = build_socket(NoAdmins, items)
+
+      assert_raise Backpex.ForbiddenError, fn ->
+        ItemAction.handle_item_action(socket, %{module: EchoAction}, :delete, items, &after_handle/1)
+      end
+
+      refute_received {:handled, _items, _key}
+    end
+
+    test "raises ForbiddenError when a selected item became unauthorized after it was selected" do
+      # Nothing about the selection says so — only the reload does.
+      socket = build_socket(NoAdmins, [%{id: 1, role: :admin}])
+
+      assert_raise Backpex.ForbiddenError, fn ->
+        ItemAction.handle_item_action(socket, %{module: EchoAction}, :delete, [%{id: 1, role: :user}], &after_handle/1)
+      end
+
+      refute_received {:handled, _items, _key}
+    end
+
+    test "raises NoResultsError for a nil item and never calls handle/3" do
+      socket = build_socket(AllowAll)
+
+      assert_raise Backpex.NoResultsError, fn ->
+        ItemAction.handle_item_action(socket, %{module: EchoAction}, :delete, [nil], &after_handle/1)
+      end
+
+      refute_received {:handled, _items, _key}
+    end
+
+    test "raises NoResultsError when a selected row vanished and never calls handle/3" do
+      socket = build_socket(AllowAll)
+
+      assert_raise Backpex.NoResultsError, fn ->
+        ItemAction.handle_item_action(socket, %{module: EchoAction}, :delete, [%{id: 1, role: :user}], &after_handle/1)
+      end
+
+      refute_received {:handled, _items, _key}
+    end
+
+    test "never calls handle/3 for an empty selection but still runs after_handle" do
+      socket = build_socket(AllowAll)
+
+      assert {:after_handle, _socket} =
+               ItemAction.handle_item_action(socket, %{module: EchoAction}, :delete, [], &after_handle/1)
+
+      refute_received {:handled, _items, _key}
+    end
+
+    test "raises ArgumentError on an unexpected return value" do
+      socket = build_socket(AllowAll, [%{id: 1}])
+
+      assert_raise ArgumentError, ~r/Invalid return value/, fn ->
+        ItemAction.handle_item_action(socket, %{module: BadReturnAction}, :delete, [%{id: 1}], &after_handle/1)
+      end
+    end
+  end
+end
diff --git a/test/backpex/live_resource_test.exs b/test/backpex/live_resource_test.exs
index d4553402a..f302e249a 100644
--- a/test/backpex/live_resource_test.exs
+++ b/test/backpex/live_resource_test.exs
@@ -4,6 +4,7 @@ defmodule Backpex.LiveResourceTest do
   import Ecto.Query
 
   alias Backpex.Adapters.Ecto, as: EctoAdapter
+  alias Backpex.ItemActions.Delete
   alias Backpex.LiveResource
 
   defmodule TestPost do
@@ -82,6 +83,34 @@ defmodule Backpex.LiveResourceTest do
     end
   end
 
+  describe "fetch_action!/2" do
+    @actions [delete: %{module: Delete}, show: %{module: Backpex.ItemActions.Show}]
+
+    test "returns the registration for a known key" do
+      assert LiveResource.fetch_action!(@actions, "delete") == {:delete, %{module: Delete}}
+    end
+
+    test "raises NoResultsError for an unregistered key" do
+      # Matching binaries rather than `String.to_existing_atom/1` keeps a forged key a 404 instead
+      # of an ArgumentError that depends on which atoms happen to exist in the running system.
+      assert_raise Backpex.NoResultsError, fn ->
+        LiveResource.fetch_action!(@actions, "no_such_action_key")
+      end
+    end
+
+    test "raises NoResultsError for an existing atom that is not registered here" do
+      assert_raise Backpex.NoResultsError, fn ->
+        LiveResource.fetch_action!(@actions, "edit")
+      end
+    end
+
+    test "raises NoResultsError for a non-binary key" do
+      assert_raise Backpex.NoResultsError, fn ->
+        LiveResource.fetch_action!(@actions, ["delete"])
+      end
+    end
+  end
+
   describe "Index.handle_event/3" do
     test "toggle_column is a no-op for a field the resource does not know" do
       # `field` arrives in a client-controlled event payload; an unknown name
diff --git a/test/backpex/resource_test.exs b/test/backpex/resource_test.exs
new file mode 100644
index 000000000..06499df8d
--- /dev/null
+++ b/test/backpex/resource_test.exs
@@ -0,0 +1,337 @@
+defmodule Backpex.ResourceTest do
+  use ExUnit.Case, async: true
+
+  alias Backpex.Resource
+  alias Backpex.Test.LiveResources
+  alias Backpex.Test.LiveResources.AllowAll
+  alias Backpex.Test.LiveResources.DenyAll
+  alias Backpex.Test.LiveResources.NoAdmins
+  alias Backpex.Test.LiveResources.OnlyCustomKey
+  alias Backpex.Test.LiveResources.Recording
+  alias Phoenix.LiveView.Socket
+
+  setup do
+    start_supervised!({Phoenix.PubSub, name: LiveResources.pubsub_server()})
+    :ok = Phoenix.PubSub.subscribe(LiveResources.pubsub_server(), LiveResources.pubsub_topic())
+
+    %{assigns: %{some: :assign}, item: %{id: 1}, fields: []}
+  end
+
+  describe "insert/6" do
+    test "authorizes :new with a nil item before building the changeset", %{assigns: assigns, item: item, fields: f} do
+      assert {:ok, ^item} = Resource.insert(item, %{}, f, assigns, Recording)
+
+      assert_received {:can?, :new, nil}
+    end
+
+    test "raises before change/6 when not authorized", %{assigns: assigns, item: item, fields: f} do
+      assert_raise Backpex.ForbiddenError, fn ->
+        Resource.insert(item, %{}, f, assigns, DenyAll)
+      end
+
+      refute_received {:adapter, :change, _opts}
+      refute_received {:adapter, :insert, _item, _attrs}
+    end
+
+    test "broadcasts on success", %{assigns: assigns, item: item, fields: f} do
+      assert {:ok, ^item} = Resource.insert(item, %{}, f, assigns, AllowAll)
+
+      assert_received {"created", ^item}
+      assert_received {"backpex:created", ^item}
+    end
+
+    test "honors :authorization_action", %{assigns: assigns, item: item, fields: f} do
+      assert_raise Backpex.ForbiddenError, fn ->
+        Resource.insert(item, %{}, f, assigns, OnlyCustomKey)
+      end
+
+      assert {:ok, ^item} =
+               Resource.insert(item, %{}, f, assigns, OnlyCustomKey, authorization_action: :custom_key)
+    end
+
+    test "honors authorize?: false", %{assigns: assigns, item: item, fields: f} do
+      assert {:ok, ^item} = Resource.insert(item, %{}, f, assigns, DenyAll, authorize?: false)
+
+      assert_received {:adapter, :insert, ^item, _attrs}
+    end
+
+    test "does not leak authorization options into change/6", %{assigns: assigns, item: item, fields: f} do
+      opts = [authorization_action: :custom_key, authorize?: true, assocs: [tags: []]]
+
+      assert {:ok, ^item} = Resource.insert(item, %{}, f, assigns, OnlyCustomKey, opts)
+
+      assert_received {:adapter, :change, change_opts}
+      refute Keyword.has_key?(change_opts, :authorization_action)
+      refute Keyword.has_key?(change_opts, :authorize?)
+      assert Keyword.get(change_opts, :assocs) == [tags: []]
+      assert Keyword.get(change_opts, :action) == :insert
+    end
+
+    test "raises when :authorize? is not a boolean", %{assigns: assigns, item: item, fields: f} do
+      assert_raise ArgumentError, fn ->
+        Resource.insert(item, %{}, f, assigns, AllowAll, authorize?: :nope)
+      end
+    end
+
+    test "raises when :authorization_action is nil and never reaches the adapter", %{
+      assigns: assigns,
+      item: item,
+      fields: f
+    } do
+      # `Keyword.pop/3` hands back an explicitly passed `nil` instead of the default, and `nil` is
+      # an atom — so without validation this would check `can?(assigns, nil, item)`, which a
+      # permissive catch-all clause happily authorizes.
+      assert_raise ArgumentError, ~r/:authorization_action/, fn ->
+        Resource.insert(item, %{}, f, assigns, DenyAll, authorization_action: nil)
+      end
+
+      refute_received {:adapter, :change, _opts}
+      refute_received {:adapter, :insert, _item, _attrs}
+    end
+
+    test "raises when :authorization_action is not an atom", %{assigns: assigns, item: item, fields: f} do
+      assert_raise ArgumentError, ~r/:authorization_action/, fn ->
+        Resource.insert(item, %{}, f, assigns, AllowAll, authorization_action: "custom_key")
+      end
+    end
+  end
+
+  describe "update/6" do
+    test "authorizes :edit with the item", %{assigns: assigns, item: item, fields: f} do
+      assert {:ok, ^item} = Resource.update(item, %{}, f, assigns, Recording)
+
+      assert_received {:can?, :edit, ^item}
+    end
+
+    test "raises before change/6 when not authorized", %{assigns: assigns, item: item, fields: f} do
+      assert_raise Backpex.ForbiddenError, fn ->
+        Resource.update(item, %{}, f, assigns, DenyAll)
+      end
+
+      refute_received {:adapter, :change, _opts}
+      refute_received {:adapter, :update, _item, _attrs}
+    end
+
+    test "broadcasts on success", %{assigns: assigns, item: item, fields: f} do
+      assert {:ok, ^item} = Resource.update(item, %{}, f, assigns, AllowAll)
+
+      assert_received {"updated", ^item}
+      assert_received {"backpex:updated", ^item}
+    end
+
+    test "honors :authorization_action and authorize?: false", %{assigns: assigns, item: item, fields: f} do
+      assert {:ok, ^item} =
+               Resource.update(item, %{}, f, assigns, OnlyCustomKey, authorization_action: :custom_key)
+
+      assert {:ok, ^item} = Resource.update(item, %{}, f, assigns, DenyAll, authorize?: false)
+    end
+  end
+
+  describe "reload/4" do
+    test "returns the current records, in the order they were given", %{fields: f} do
+      fresh = [%{id: 1, role: :admin}, %{id: 2, role: :user}]
+      assigns = %{stub_records: Map.new(fresh, &{&1.id, &1})}
+
+      stale = [%{id: 1, role: :user}, %{id: 2, role: :user}]
+
+      assert Resource.reload(stale, f, assigns, AllowAll) == fresh
+    end
+
+    test "keeps a vanished record as nil in its position", %{fields: f} do
+      assigns = %{stub_records: %{2 => %{id: 2, role: :user}}}
+
+      items = [%{id: 1, role: :user}, %{id: 2, role: :user}, %{id: 3, role: :user}]
+
+      assert Resource.reload(items, f, assigns, AllowAll) == [nil, %{id: 2, role: :user}, nil]
+    end
+
+    test "a nil entry stays nil and is not looked up", %{fields: f} do
+      assigns = %{stub_records: %{}}
+
+      assert Resource.reload([nil], f, assigns, AllowAll) == [nil]
+
+      refute_received {:adapter, :get, _primary_value}
+    end
+
+    test "reads by primary value, not by identity", %{fields: f} do
+      assigns = %{stub_records: %{7 => %{id: 7}}}
+
+      assert Resource.reload([%{id: 7, stale: true}], f, assigns, AllowAll) == [%{id: 7}]
+
+      assert_received {:adapter, :get, 7}
+    end
+
+    test "is a read and never authorizes", %{fields: f} do
+      assigns = %{stub_records: %{1 => %{id: 1}}}
+
+      assert Resource.reload([%{id: 1}], f, assigns, DenyAll) == [%{id: 1}]
+    end
+
+    test "does not touch the adapter for an empty list", %{fields: f} do
+      assert Resource.reload([], f, %{}, AllowAll) == []
+
+      refute_received {:adapter, :get, _primary_value}
+    end
+  end
+
+  describe "delete_all/4" do
+    test "authorizes :delete per item", %{assigns: assigns} do
+      items = [%{id: 1}, %{id: 2}]
+
+      assert {:ok, ^items} = Resource.delete_all(items, assigns, Recording)
+
+      assert_received {:can?, :delete, %{id: 1}}
+      assert_received {:can?, :delete, %{id: 2}}
+    end
+
+    test "raises for the whole call when a single item is unauthorized", %{assigns: assigns} do
+      items = [%{id: 1, role: :user}, %{id: 2, role: :admin}]
+
+      assert_raise Backpex.ForbiddenError, fn ->
+        Resource.delete_all(items, assigns, NoAdmins)
+      end
+
+      refute_received {:adapter, :delete_all, _items}
+    end
+
+    test "raises NoResultsError when the list contains nil", %{assigns: assigns} do
+      assert_raise Backpex.NoResultsError, fn ->
+        Resource.delete_all([%{id: 1}, nil], assigns, AllowAll)
+      end
+
+      refute_received {:adapter, :delete_all, _items}
+    end
+
+    test "raises when :authorization_action is nil and never reaches the adapter", %{assigns: assigns} do
+      assert_raise ArgumentError, ~r/:authorization_action/, fn ->
+        Resource.delete_all([%{id: 1}], assigns, DenyAll, authorization_action: nil)
+      end
+
+      refute_received {:adapter, :delete_all, _items}
+    end
+
+    test "passes an empty list vacuously", %{assigns: assigns} do
+      assert {:ok, []} = Resource.delete_all([], assigns, DenyAll)
+
+      assert_received {:adapter, :delete_all, []}
+    end
+
+    test "honors :authorization_action and authorize?: false", %{assigns: assigns} do
+      items = [%{id: 1}]
+
+      assert {:ok, ^items} = Resource.delete_all(items, assigns, OnlyCustomKey, authorization_action: :custom_key)
+      assert {:ok, ^items} = Resource.delete_all(items, assigns, DenyAll, authorize?: false)
+    end
+
+    test "broadcasts a deleted event per item", %{assigns: assigns} do
+      item = %{id: 1}
+
+      assert {:ok, _items} = Resource.delete_all([item], assigns, AllowAll)
+
+      assert_received {"deleted", ^item}
+      assert_received {"backpex:deleted", ^item}
+    end
+
+    test "does not answer the pre-0.21 delete_all/2 signature" do
+      # The arguments go through a variable so the compiler's type checker does not flag the
+      # intentionally wrong call — what is under test is the runtime behavior.
+      args = [[%{id: 1}], AllowAll]
+
+      assert_raise UndefinedFunctionError, fn ->
+        apply(Resource, :delete_all, args)
+      end
+    end
+
+    test "refuses a socket where assigns are expected" do
+      # Passing the socket instead of its assigns would authorize against the wrong context. The
+      # `is_map/1` + `not is_struct/1` guard makes that a hard error rather than a silent mismatch.
+      args = [[%{id: 1}], %Socket{}, DenyAll]
+
+      assert_raise FunctionClauseError, fn ->
+        apply(Resource, :delete_all, args)
+      end
+
+      refute_received {:adapter, :delete_all, _items}
+    end
+  end
+
+  describe "update_all/5" do
+    test "authorizes :edit per item", %{assigns: assigns} do
+      items = [%{id: 1}, %{id: 2}]
+
+      assert {:ok, ^items} = Resource.update_all(items, [set: [x: 1]], assigns, Recording)
+
+      assert_received {:can?, :edit, %{id: 1}}
+      assert_received {:can?, :edit, %{id: 2}}
+    end
+
+    test "raises for the whole call when a single item is unauthorized", %{assigns: assigns} do
+      items = [%{id: 1, role: :user}, %{id: 2, role: :admin}]
+
+      assert_raise Backpex.ForbiddenError, fn ->
+        Resource.update_all(items, [set: [x: 1]], assigns, NoAdmins)
+      end
+
+      refute_received {:adapter, :update_all, _items, _updates}
+    end
+
+    test "raises NoResultsError when the list contains nil", %{assigns: assigns} do
+      assert_raise Backpex.NoResultsError, fn ->
+        Resource.update_all([%{id: 1}, nil], [set: [x: 1]], assigns, AllowAll)
+      end
+
+      refute_received {:adapter, :update_all, _items, _updates}
+    end
+
+    test "passes an empty list vacuously", %{assigns: assigns} do
+      assert {:ok, []} = Resource.update_all([], [set: [x: 1]], assigns, DenyAll)
+    end
+
+    test "broadcasts the default event", %{assigns: assigns} do
+      item = %{id: 1}
+
+      assert {:ok, _items} = Resource.update_all([item], [set: [x: 1]], assigns, AllowAll)
+
+      assert_received {"updated", ^item}
+      assert_received {"backpex:updated", ^item}
+    end
+
+    test "honors :event_name", %{assigns: assigns} do
+      item = %{id: 1}
+
+      assert {:ok, _items} = Resource.update_all([item], [set: [x: 1]], assigns, AllowAll, event_name: "deleted")
+
+      assert_received {"deleted", ^item}
+      assert_received {"backpex:deleted", ^item}
+    end
+
+    test "honors :authorization_action and authorize?: false", %{assigns: assigns} do
+      items = [%{id: 1}]
+
+      assert {:ok, ^items} =
+               Resource.update_all(items, [set: [x: 1]], assigns, OnlyCustomKey, authorization_action: :custom_key)
+
+      assert {:ok, ^items} = Resource.update_all(items, [set: [x: 1]], assigns, DenyAll, authorize?: false)
+    end
+
+    test "does not answer the pre-0.21 update_all/3 signature" do
+      # The old head had `event_name \\ "updated"`, so it defined an arity-3 function too.
+      args = [[%{id: 1}], [set: [x: 1]], AllowAll]
+
+      assert_raise UndefinedFunctionError, fn ->
+        apply(Resource, :update_all, args)
+      end
+    end
+
+    test "raises FunctionClauseError for the pre-0.21 update_all/4 signature", %{assigns: _assigns} do
+      # `update_all(items, updates, "deleted", MyLive)` has the same arity as the new
+      # `update_all(items, updates, assigns, live_resource)`. The `is_map(assigns)` guard makes the
+      # old call fail loudly instead of silently authorizing against a string.
+      args = [[%{id: 1}], [set: [x: 1]], "deleted", AllowAll]
+
+      assert_raise FunctionClauseError, fn ->
+        apply(Resource, :update_all, args)
+      end
+    end
+  end
+end
diff --git a/test/support/live_resources.ex b/test/support/live_resources.ex
new file mode 100644
index 000000000..bbf455a7c
--- /dev/null
+++ b/test/support/live_resources.ex
@@ -0,0 +1,141 @@
+defmodule Backpex.Test.StubAdapter do
+  @moduledoc """
+  A `Backpex.Adapter` stand-in that performs no I/O.
+
+  Every call reports back to the calling process as `{:adapter, function_name, ...}`, so a test can
+  use `refute_received/1` to prove that a denied mutation never reached the data layer.
+  """
+
+  @doc """
+  Reads one record from the fake store in `assigns.stub_records`, a map of primary value to record.
+
+  `Backpex.Resource.reload/4` — and therefore every item action execution gate — goes through this,
+  so a test can make a record change or vanish between selecting it and acting on it just by
+  handing the gate a different store. A primary value the store does not know returns `{:ok, nil}`,
+  which is what a deleted or out-of-scope row looks like.
+  """
+  def get(primary_value, _fields, assigns, _live_resource) do
+    send(self(), {:adapter, :get, primary_value})
+
+    {:ok, assigns |> Map.get(:stub_records, %{}) |> Map.get(primary_value)}
+  end
+
+  def change(item, attrs, _fields, _assigns, _live_resource, opts) do
+    send(self(), {:adapter, :change, opts})
+
+    {:changeset, item, attrs}
+  end
+
+  def insert({:changeset, item, attrs}, _live_resource) do
+    send(self(), {:adapter, :insert, item, attrs})
+
+    {:ok, item}
+  end
+
+  def update({:changeset, item, attrs}, _live_resource) do
+    send(self(), {:adapter, :update, item, attrs})
+
+    {:ok, item}
+  end
+
+  def delete_all(items, _live_resource) do
+    send(self(), {:adapter, :delete_all, items})
+
+    {:ok, items}
+  end
+
+  def update_all(items, updates, _live_resource) do
+    send(self(), {:adapter, :update_all, items, updates})
+
+    {length(items), nil}
+  end
+end
+
+defmodule Backpex.Test.LiveResources do
+  @moduledoc """
+  Fake LiveResource modules with hand-written `can?/3` clauses, shared by the authorization, item
+  action and resource tests.
+
+  Each module implements only what `Backpex.Authorization`, `Backpex.Resource` and
+  `Backpex.ItemAction` touch: `can?/3`, `config/1` for the adapter and the primary key, `fields/0`
+  and `pubsub/0`. Tests that need the PubSub broadcasts have to start
+  `{Phoenix.PubSub, name: #{inspect(__MODULE__)}.pubsub_server()}` themselves.
+  """
+
+  alias Backpex.Test.PubSub
+  alias Backpex.Test.StubAdapter
+
+  @pubsub_server PubSub
+  @pubsub_topic "backpex_test"
+
+  @doc "Name of the PubSub server every fake LiveResource in this module broadcasts on."
+  def pubsub_server, do: @pubsub_server
+
+  @doc "Topic every fake LiveResource in this module broadcasts on."
+  def pubsub_topic, do: @pubsub_topic
+
+  defmodule AllowAll do
+    @moduledoc "Authorizes everything."
+    def config(:adapter), do: StubAdapter
+    def config(:primary_key), do: :id
+    def fields, do: []
+    def can?(_assigns, _action, _item), do: true
+    def pubsub, do: [server: PubSub, topic: "backpex_test"]
+  end
+
+  defmodule DenyAll do
+    @moduledoc "Denies everything."
+    def config(:adapter), do: StubAdapter
+    def config(:primary_key), do: :id
+    def fields, do: []
+    def can?(_assigns, _action, _item), do: false
+    def pubsub, do: [server: PubSub, topic: "backpex_test"]
+  end
+
+  defmodule NoAdmins do
+    @moduledoc "Denies every action on an item with `role: :admin`, allows everything else."
+    def config(:adapter), do: StubAdapter
+    def config(:primary_key), do: :id
+    def fields, do: []
+    def can?(_assigns, _action, %{role: :admin} = _item), do: false
+    def can?(_assigns, _action, _item), do: true
+    def pubsub, do: [server: PubSub, topic: "backpex_test"]
+  end
+
+  defmodule KeyAware do
+    @moduledoc "Answers differently per action key, including a `nil` item."
+    def config(:adapter), do: StubAdapter
+    def config(:primary_key), do: :id
+    def fields, do: []
+    def can?(_assigns, :delete, %{role: :admin} = _item), do: false
+    def can?(_assigns, :delete, _item), do: true
+    def can?(_assigns, :new, nil), do: false
+    def can?(_assigns, _action, _item), do: true
+    def pubsub, do: [server: PubSub, topic: "backpex_test"]
+  end
+
+  defmodule OnlyCustomKey do
+    @moduledoc "Authorizes `:custom_key` only, so tests can tell which action key was checked."
+    def config(:adapter), do: StubAdapter
+    def config(:primary_key), do: :id
+    def fields, do: []
+    def can?(_assigns, :custom_key, _item), do: true
+    def can?(_assigns, _action, _item), do: false
+    def pubsub, do: [server: PubSub, topic: "backpex_test"]
+  end
+
+  defmodule Recording do
+    @moduledoc "Authorizes everything and reports each check as `{:can?, action, item}`."
+    def config(:adapter), do: StubAdapter
+    def config(:primary_key), do: :id
+    def fields, do: []
+
+    def can?(_assigns, action, item) do
+      send(self(), {:can?, action, item})
+
+      true
+    end
+
+    def pubsub, do: [server: PubSub, topic: "backpex_test"]
+  end
+end