Home / Knowledge hub / Access control
Knowledge hub
Access control
The rules deciding which person can see or do which thing in your app.
What it means
Access control is the rule inside your application that decides which person may see or do which thing. A support agent reads a customer record but cannot delete it. A customer sees their own invoice and nobody else's.
The check runs after the login, on every request, and the server has to make it. Hiding a button in the interface controls nothing, because anyone can send the request behind that button by hand.
Why it matters
Most of the damage in a breach comes from someone reaching data they were never meant to reach. The attacker often holds a real account already, so the only question left is how far that account travels.
The cost is unusually wide too. One missing check rarely leaks one record. It leaks every record of that shape, because the only effort left is counting upwards.
Afterwards it is the hardest failure to explain. Customers forgive bugs. They take it less well when another customer could read their records for a year. Enterprise buyers now ask about this directly, so you want your working rather than your intentions.
How it shows up
Watch for a low privilege role calling an endpoint meant for administrators and getting a normal answer. Or one customer's identifier working inside another customer's request. Or a cancelled account that still returns data.
A role by resource matrix makes the gaps visible. Put every role down one side and every resource across the other. The cells nobody has tried are where this fails.
We build that matrix and test each cell. See the authorisation matrix.
Questions people ask
Access control, answered
Is access control just another word for authentication?
No. Authentication answers who you are. Access control answers what you may do once you are in. They are separate checks, and you can pass the first and still be stopped by the second.
Plenty of breaches involve users who logged in correctly. The login worked. The rule about what that account could reach did not.
Can I just hide the buttons a user should not see?
No. Hiding a button removes it from the screen, not from the server. Anyone can open the developer tools, read the request that button would have sent, and send it themselves.
The check has to live in the code that answers the request. Treat the interface as a convenience for honest users and nothing more.
What is the difference between RBAC and an access control list?
An access control list attaches permissions to the thing: this file may be read by these three accounts. Role based access control attaches them to the person: an editor may read anything in the editor's remit.
Roles are easier to administer and coarser. Lists are precise and get unwieldy. Most products end up with roles plus a per-record ownership check, and teams forget the second one.
Do we really need a permission check on every single method?
You need one on every path that does the work, on the server. Checking only at the route that led there breaks as soon as a second route reaches the same function.
OWASP's authorisation guidance says the same thing: validate permissions on every request rather than once at the door.
Is it safe to skip access checks for our own office IP address?
Not on its own. An address tells you where a request appears to come from, not who sent it. Offices share networks, VPNs get reused, and one compromised machine inside inherits the exemption.
Use the address as an extra condition if you want. Never use it as the only one.
Sources
Where this comes from
Related
Terms that sit next to this one
Authorization
Deciding what a proven user is then allowed to do.
Broken access control
An application failing to enforce its own rules about who may do what.
Least privilege
Giving every person and service the minimum access the job requires.
RBAC
Permissions attach to roles, and people are given roles.
IDOR
Changing an id in a request and getting back someone else's record.
Who can reach what today?
We log in as every role you have and try each door between them, then hand back the request, the response and the source line that allowed it. Ask what your matrix looks like.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.