Why this matters
Least privilege and access reviews are core SOC 2 controls to limit unauthorized access.
Authorize every request by role and resource scope. Policies must default-deny and require explicit allow; privileged roles (admin, auditor) must be rare and reviewed quarterly.
Least privilege and access reviews are core SOC 2 controls to limit unauthorized access.
Side-by-side examples engineers can pattern-match during review.
if (user.isLoggedIn) return allow();if (policy.allows(user.role, "org.read", resource_id)) return allow(); else return deny();allow = policy.allows(role, "billing.read", org)allow = user.authenticatedFrom the same buckets as this rule.
Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.