Reviewing Access Control for Admin Tools

Check permissions on every sensitive action, including direct requests.

Identify the information and actions that need protection, then enforce access and validation at the server boundary.

Test unauthorized and malformed requests as well as the normal workflow. Keep a clear update and recovery process for the people operating the system.