---
name: Access Control
description: Grant the minimum access necessary.
---
# Access Control

Most breaches are an access-control failure: someone reaches something they shouldn't. Strong authn with weak authz still leaks.

## Principles
- **Authentication (who).** Strong: MFA, short-lived credentials, hardware keys for high-privilege. Long-lived passwords and shared credentials are legacy risk.
- **Authorization (what).** Checked on every action, not just at login. The most common bug (IDOR) is authz missing on a per-resource action.
- **Least privilege.** Default to no access; grant as needed with time limits. Standing admin access is the highest-risk state.
- **Audit.** Log access, especially privileged. Anomalous access patterns are how you detect compromise.

## Lifecycle
- Onboard → grant minimum. Role change → adjust. Offboard → revoke immediately, comprehensively (forgetting one system is how ex-employees retain access).