---
title: "Access control · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/access-control
parts: 4
tokens_total: 3523
updated: 2026-10-27
build: a2a6bdfed830
tokens: 623
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Access control

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Application security](https://agentwranglers.se/playbook/application-security.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

> Check on the server, on every request, who is asking and what they may touch. Deny by default and decide access in one place for every route.

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/access-control">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

## Required

- APS-20 [Deny by default and when a check fails](https://agentwranglers.se/playbook/application-security/access-control/fail-closed.md) · 1,042 tokens · updated 2026-10-27
  Make every route need a login unless it is on a named public list. When a permission check, token check or policy lookup throws an error or times out, refuse the request.
- APS-21 [Accept only the fields you expect](https://agentwranglers.se/playbook/application-security/access-control/mass-assignment.md) · 733 tokens · updated 2026-10-27
  Copy only named fields from a request into a record. Never save the whole request body.

## Recommended

- APS-101 [Decide access in one policy module](https://agentwranglers.se/playbook/application-security/access-control/policy-decision-point.md) · 1,074 tokens · updated 2026-10-27
  Answer every access question through one policy function or service, the policy decision point. Every route asks it "may this user do this action on this record?" and never decides alone.
- APS-22 [Return only the fields needed](https://agentwranglers.se/playbook/application-security/access-control/only-needed-fields.md) · 674 tokens · updated 2026-10-27
  Each API reply returns only the fields the caller needs and may see. Never send a whole database record and let the page hide the rest.

- Previous: [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md)
- Next: [Browser security headers](https://agentwranglers.se/playbook/application-security/browser-security-headers.md)
- [All chapters](https://agentwranglers.se/playbook/application-security.md)