Access Control: Start with Deny, Then Grant What Is Needed

Environment and inputs: A staging application, two separate test accounts and one synthetic record owned by each account.

Signing in should not unlock every record. Applications must verify permission for the requested action and resource. OWASP recommends denying access by default and validating permissions on every request, including calls made directly to an endpoint rather than through the visible interface.

What matters

• Define permissions around actual responsibilities and resource ownership.
• Enforce checks on the server instead of relying on hidden buttons.
• Test access between accounts, roles, and organisations, not just a successful login.

Practical example: A customer portal confirms that an invoice belongs to the signed-in customer before returning it.

One action today: Test whether a normal user can retrieve another user’s record by changing its identifier.