# Access Control

Record: `arch:access-control`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: API, data, infrastructure
Canonical: https://banes-lab.com/ontology#arch-access-control

## Repair

- Refactored by: Add ACL/RBAC/ABAC Policy
- Detected by: resource endpoint lacking policy
- Violated by: broad or missing access controls
- Measured by: access control coverage
- Enforced by: policy tests

## requires

- [Authorization Policy](https://banes-lab.com/records/lex/authorization-policy.md)

## reinforces

- [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)

## enables

- [Resource Protection](https://banes-lab.com/records/lex/resource-protection.md)

## conflicts-with

- [Unrestricted Access](https://banes-lab.com/records/lex/unrestricted-access.md)

## tensions-with

- [Usability](https://banes-lab.com/records/lex/usability.md)

## tensions

- [Access Control Usability](https://banes-lab.com/records/tension/access-control-usability.md)

## referenced-by

- [Centralized Configuration](https://banes-lab.com/records/arch/centralized-configuration.md)
- [Least Privilege](https://banes-lab.com/records/arch/least-privilege.md)
- [Authentication](https://banes-lab.com/records/arch/authentication.md)
- [RBAC](https://banes-lab.com/records/arch/role-based-access-control.md)
- [Session Management](https://banes-lab.com/records/arch/session-management.md)