Free Download
Access Control Brief Sheet
Access control is the one thing that cannot be retrofitted cheaply, because it spreads through the whole codebase as it is written. This sheet settles it before anyone draws a screen.
What Is In The Access Control Brief Sheet
- How to list what the software holds, rather than its screens.
- Who may view each record type, and whether that means all or only their own.
- Who may create, edit and delete, and what must never be deleted.
- What must be attributable to a person after the fact.
- How you would find out that someone saw something they should not have.
- The difference between authentication and authorisation, in one paragraph.
- How to hand it to a supplier, and what to ask them to send back.
Why It Comes Before The Screens
OWASP puts Broken Access Control first in its 2025 list and reports that 100% of the applications tested were found to have some form of it. A brief that says users must log in has specified authentication and said nothing about authorisation, and authorisation is where that category lives. A quote priced per screen will not include this work, because it is not a screen.
The full reasoning is in the article this accompanies: What Decides Whether A Web Application Is Safe To Ship.
Prefer A Second Opinion On Your Permissions?
The scoping audit is free. The form asks for your website or store URL and a note on what is eating the time, and a build you are about to commission is a reasonable thing to put in that box.
Request The Free Scoping Audit