If It Matters, Make the System Enforce It

Every organisation has rules that everybody knows and nobody has written down. Get the client’s permission before publishing their name. Do not email that list without checking who is on it. Only these people can see referrals. They hold perfectly well right up until someone is covering for a colleague on a Friday afternoon.

Put the rule where it cannot be skipped

On our own site, a client case study cannot be published unless it is separately marked as client approved. Not as a warning, not as a checklist item in a document. The publish action refuses, and says why. Approval and publication are two deliberate acts, and writing the copy is not one of them.

It cost about twenty minutes to build. It permanently removes a category of mistake that would be genuinely damaging to a client relationship, and it means nobody has to remember anything.

Enforce it at the layer that cannot be bypassed

This matters more than it sounds. A check in the interface is a suggestion, because the interface is running on someone else’s computer and can be worked around. On a client system with six staff roles and real regulatory obligations, we moved the access rules into the database itself, where they apply regardless of what the browser sends, and wrote a test suite that proves each role can reach exactly what it should and nothing else.

• Ask what would actually go wrong, and how bad it would be
• If the answer involves a client, a regulator or personal data, encode it
• Enforce it at the layer nobody can route around, which is almost never the interface
• Write the test that proves it, including the case that should be refused

The test that is worth writing

Most access control testing proves the right people get in. The valuable half is proving the wrong people do not, including the ones who are nearly right: the colleague with a similar role, the account that used to have access, the request that arrives without going through the screen you designed. That is the half that fails, and it is usually the half nobody wrote.