Agent WranglersAccess control
Check on the server, on every request, who is asking and what they may touch. Deny by default and decide access in one place for every route.
- Required 2
- Recommended 2
Required
Deny by default and when a check fails
APS-20Make every route need a login unless it is on a named public list. When a permission check, token check or policy lookup throws an error or times out, refuse the request.
Accept only the fields you expect
APS-21Copy only named fields from a request into a record. Never save the whole request body.
Recommended
Decide access in one policy module
APS-101Answer every access question through one policy function or service, the policy decision point. Every route asks it "may this user do this action on this record?" and never decides alone.
Return only the fields needed
APS-22Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/access-control">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.