# Access control: who decides and who executes?

https://thiago.limaesilvatecnologia.com.br/en/artigos/access-control/

Published: 2026-09-12

Clear responsibilities prevent ownerless permissions.

Content produced with AI assistance for Thiago Silva’s website. Independent editorial analysis; it does not represent clients or employers.

Reading-path month: January 2026

Collection published on September 12, 2026. Months organize the reading path; they are not earlier publication dates.

A short architecture article. The technical reference supports the topic; hypothetical scenarios and assessment proposals are editorial analysis, not accounts of personal implementations.

## The architecture decision

Access reviews often start with a user list. A more useful question is who can change the rule permitting an operation. When one person requests, approves and implements sensitive access, periodic review loses strength.

## Practical application

In a hypothetical support workflow, separate the data owner from the administrator configuring access. Record the reason, expiry and revocation path. Exceptions must remain visible when their owner changes teams.

## How to verify

Editorial proposal: trace one critical permission through its full lifecycle. Evidence should show approval, application and removal. Counting fulfilled requests rewards speed; tracking expired access exposes operational debt.

## Sources

- [OWASP — Access Control Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Access_Control_Cheat_Sheet.html). Accessed: 2026-09-12.

[Profile: Thiago Silva | Cyber Architect](https://thiago.limaesilvatecnologia.com.br/en/perfil/)