Address OWASP Top 10 A01 Broken Access Control per OWASP Top 10:2025. Broken Access Control occurs when authorisation enforcement is missing + bypassable + inconsistent across web applications including bypass via URL tampering + forced browsing + tampering with metadata + role manipulation + insecure direct object reference (IDOR) + missing function-level access checks + CORS misconfiguration. Mitigations include (a) implement access control as server-side enforcement consistently across all routes + (b) implement deny-by-default policy with explicit allow + (c) implement object-level + function-level + property-level access checks + (d) implement RBAC + ABAC where appropriate + (e) protect against IDOR via unpredictable identifiers + ownership checks + (f) implement rate limiting + lockout against access control brute force + (g) test access control thoroughly across user roles + tenancy boundaries + with negative testing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.