--- title: "Questions that shape a useful access-control model — Orvun Labs" description: "Access control starts with a business question: who may do what to which record, under which circumstances?" canonical: "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model" language: "en" last_modified: "2026-09-13" --- # Questions that shape a useful access-control model Access control starts with a business question: who may do what to which record, under which circumstances? ![Editorial diagram of connected steps and decision points](https://orvunlabs.com/images/blog/design.svg) - Published: 2026-09-13T09:00:00.000Z - [Quality & reliability](https://orvunlabs.com/en/journal/topic/design.md) ## Define the result first Access control starts with a business question: who may do what to which record, under which circumstances? A list of role names is not enough. Identify actions, ownership boundaries and exceptional authority before choosing a permission structure. Reading a record, editing it, exporting it and assigning access to it are different powers. ## Choose the right approach A simple role model can fit a small internal application. Record ownership, organization membership or workflow state may require additional checks. Avoid creating a new role for every possible combination if a few explicit attributes describe the rule more clearly. OWASP recommends denying access by default and validating permissions on every request; hiding a button is not an enforcement boundary. ## Reconcile a concrete case Imagine a partner portal where an account manager reads orders for their own company and a finance user downloads invoices. Test each action with another company's record identifier, including direct download URLs and search results. Then remove a user's company membership while their browser remains open. The next protected request must reflect the new decision, not rely on the interface they loaded earlier. ## Keep the evidence useful Do not give support staff permanent unrestricted access merely because troubleshooting is easier. If exceptional access is needed, define its reason, duration and record. Check bulk exports, background jobs and integration credentials as carefully as individual screens. A permission spreadsheet is useful only when its rules also become executable checks and negative test cases. ## Build the matrix from actions and boundaries Create one row for each meaningful action and one column for each role, then annotate the record boundary. An account manager may read an order only inside their assigned organization; that condition is part of the permission, not a note to remember later. Include actions that do not have an obvious button: search, download, export, background processing and granting another person's access. A model that covers editing but forgets export can still expose the same protected records. Walk through the lifecycle of authority. Who invites a user, verifies their organization, changes their role and removes them? Decide whether sensitive changes need a second person and how emergency access expires. Distinguish the right to operate the business from the right to administer the application. A manager who approves a purchase does not automatically need to change authentication settings or read another organization's records. Keep service identities for integrations scoped to their actual tasks, with a clear owner and a way to revoke them. Turn the matrix into examples that can fail as well as pass. For each protected action, test an allowed record, a same-role record outside the allowed organization, a revoked membership and a direct request that bypasses the screen. Repeat relevant checks for bulk and queued work, where permissions may have changed between selection and execution. Preserve enough audit information to explain who authorized a sensitive operation without copying its entire personal payload. During review, ask the operator to investigate a rejected action using that evidence. A clear denial should protect the boundary and give a legitimate user a practical correction route, without revealing records they are not entitled to see. ## Permission acceptance cases | Case | Expected boundary | | --- | --- | | Same role, different organization | Role similarity does not grant cross-organization access to records, search results or attachments. | | Membership revoked during an open session | The next protected action uses current authority rather than relying on an earlier rendered control. | | User attempts their own elevation | The configured approval rule is enforced and the attempted change is traceable without silently granting power. | | Queued export runs after access changes | Execution follows the agreed authorization policy and does not distribute records solely because an old selection once existed. | ## Questions for the owner Who grants and revokes access? Can someone approve their own elevation? Which records must remain separate even within one role? Bring a role-action-record matrix and examples of denied work to a custom-software review. The missing permissions are as important to discuss as the permitted ones. ## Sources & further reading - [OWASP — Authorization cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) ## Custom software Software that follows the way your business works. - [Discuss this service](https://orvunlabs.com/en/services/custom-software.md) ## Related reading - [Setting a performance budget that supports the product](https://orvunlabs.com/en/journal/setting-a-performance-budget-that-supports-the-product.md) - [Monitoring whether the business workflow actually finishes](https://orvunlabs.com/en/journal/monitoring-whether-the-business-workflow-actually-finishes.md) - [Having a backup is different from being able to restore](https://orvunlabs.com/en/journal/having-a-backup-is-different-from-being-able-to-restore.md) ## Let's make something useful. A first product, a difficult workflow or software that needs a fresh start. Tell us where you are. - [Tell us about your project](https://orvunlabs.com/en/contact) ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://orvunlabs.com/#organization", "name": "Orvun Labs", "url": "https://orvunlabs.com", "logo": "https://orvunlabs.com/orvunlabs-icon-512.png", "description": "Custom software, SaaS products and AI-powered tools — designed around your business.", "knowsAbout": [ "Custom software", "SaaS product development", "AI integration" ] }, { "@type": "WebSite", "@id": "https://orvunlabs.com/#website", "name": "Orvun Labs", "url": "https://orvunlabs.com", "inLanguage": [ "en", "es", "de", "fr", "pt", "ja", "hi", "ar", "id", "tr", "pl" ], "publisher": { "@id": "https://orvunlabs.com/#organization" } }, { "@type": "WebPage", "@id": "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model#webpage", "url": "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model", "name": "Questions that shape a useful access-control model", "description": "Access control starts with a business question: who may do what to which record, under which circumstances?", "inLanguage": "en", "isPartOf": { "@id": "https://orvunlabs.com/#website" }, "about": { "@id": "https://orvunlabs.com/#organization" }, "breadcrumb": { "@id": "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model#breadcrumb" } }, { "@type": "BreadcrumbList", "@id": "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Orvun Labs", "item": "https://orvunlabs.com/en" }, { "@type": "ListItem", "position": 2, "name": "Questions that shape a useful access-control model", "item": "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model" } ] }, { "@type": "BlogPosting", "headline": "Questions that shape a useful access-control model", "description": "Access control starts with a business question: who may do what to which record, under which circumstances?", "datePublished": "2026-09-13T09:00:00.000Z", "dateModified": "2026-09-13T09:00:00.000Z", "inLanguage": "en", "author": { "@id": "https://orvunlabs.com/#organization" }, "publisher": { "@id": "https://orvunlabs.com/#organization" }, "image": [ "https://orvunlabs.com/images/blog/design.svg" ], "mainEntityOfPage": { "@id": "https://orvunlabs.com/en/journal/questions-that-shape-a-useful-access-control-model#webpage" } } ] } ```