Accounts and access
Authentication establishes who is using the app. Authorization determines what that person may see and do. Define both when the experience includes private records, saved projects, or administrative actions.
Describe the boundary
Section titled “Describe the boundary”Customers can read their own project documents and create requests. Staff can review requests assigned to them. Only administrators can change access.
Add ownership or membership information to the records that need it. Give the same boundary to an agent retrieving context or performing an action for a user.
Verify the behavior
Section titled “Verify the behavior”Try a normal account, a second account, and a signed-out session. Test direct links and data requests as well as visible menus. A sign-in screen alone does not establish private data access.
Use the authentication options available for the app and check their account and usage requirements before release.