I'm thinking about a client-side encryption concept where only the client knows the master secret (a user password). A correct implementation assumed, with KDF and authenticated encryption solutions it should be possible to ensure confidentiality and integrity without submitting the secret (from password derived key) to the server and also without saving the secret at the server.
But what is with authorization in this scenario? How can I control access to resources without a "login process" on the server? E.g. how can I prevent that a user deletes a resource from another user?
My only idea is using a CSPRNG to generate a random ID for each resource. But then resource IDs will be turned into sensitive informations, what doesn't seems perfectly reasonable to me.
Are there any strategies/technologies that I am missing? Thank you for pointing me in a new direction.