Route loader authentication and granular permission boundaries

Route-level Data Fetching and Access Control

React Router v6+ utilizes the loader function to handle data pre-fetching and authentication guards before a route component renders. While throwing a redirect or a 401 Response effectively handles global authentication states, implementing a least-privilege model for Role-Based Access Control (RBAC) typically requires custom wrapper components or manual logic within every loader.

Permission Constraints

There is currently no declarative mechanism within the route definition object to specify granular permission requirements. This forces developers to either duplicate authorization logic across multiple loaders or create higher-order components that execute after the loader has already resolved.

• Requirement: Prevent the loader from executing if the user lacks specific granular permissions.
• Constraint: Avoid wrapping every protected route in a redundant authorization component.

Is there a documented pattern for defining permission boundaries directly within the route configuration to trigger redirects before the loader executes? How can these boundaries be managed centrally to prevent infinite redirect loops when credentials expire?