access-control-review

name	access-control-review
description	Reviews access control, authentication, and authorization patterns. Use when reviewing security boundaries, permission models, role-based access, or authentication flows.
tags	["security","access-control","authentication","authorization","review","permissions","RBAC"]

Access Control Review

Systematic review of access control patterns in applications.

When To Use

• Reviewing authentication and authorization implementations
• Auditing role-based access control (RBAC) configurations
• Checking permission boundaries and security policies
• Reviewing OAuth, JWT, or session-based auth flows

Review Checklist

1. Authentication — Verify identity mechanisms are secure
2. Authorization — Confirm permission checks at every boundary
3. Least Privilege — Ensure minimal access grants
4. Audit Trail — Check logging of access decisions