Enforce least privilege and complete mediation in access control design. Use when reviewing authorization models, RBAC configurations, API access controls, or evaluating whether every request is authorized before access is granted.
