access-control-security-best-practiceslisted

# Access Control Security Best Practices Use this skill when designing or reviewing authentication-to-authorization boundaries, RBAC or ABAC policies, tenant isolation, service identities, administrative actions, or permission regressions. Authentication proves who or what is acting; authorization decides whether that principal may perform this action on this resource in this context. Never treat a login, client-side flag, hidden UI control, or predictable identifier as authorization evidence. ## Map the authorization contract Start with the protected assets, operations, principals, trust boundaries, tenants, environments, and policy owners. For each operation document: - subject and authenticated identity source; - resource and authoritative ownership or tenant relation; - action, context, and required decision point; - allowed, denied, missing, expired, and degraded behavior; - policy version, audit event, and decision owner. Separate human, service, background-job, support, and break-glass identities. Use server-side authoritative identifiers and derive tenant scope from trusted session or service context, never from an unverified request field. Make cross-tenant access an explicit, narrow policy rather than an accidental result of a shared query or cache. ## Design for least privilege Default to deny and grant only the actions and fields required for the task. Prefer resource- and action-level checks over broad roles when risk or tenancy requires it. If using RBAC,