Per OWASP ASVS V4 + V4.3: implement consistent access control. Requirements include (a) implement access control as a server-side enforcement consistently across all endpoints + (b) implement role-based + attribute-based access control where appropriate + (c) implement object-level + property-level access checks consistent with API security + (d) implement deny-by-default policy with explicit allow + (e) protect administrative + privileged endpoints with strong access control + audit + (f) implement separation of duties for sensitive operations + (g) test access control thoroughly across user roles + tenancy boundaries + with negative testing including privilege escalation attempts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.