Broken Access Control Skill

Broken access control is the number one OWASP risk category. It means the application allows users to act outside their intended permissions. An agent writing data access code does not automatically check whether the caller is allowed to see that data. This skill makes that check mandatory.

What to Check Before Writing or Modifying Access-Sensitive Code

Before generating or modifying any route, endpoint, middleware, or data query, answer each of the following:

1. Is there an authorization check? Every endpoint or function that accesses user-specific data must verify the caller's identity and permissions before touching any record. "Authenticated" is not the same as "authorized."

2. Is object-level authorization enforced? If the code retrieves a record by ID (e.g., GET /invoices/4821), confirm the owner of record 4821 matches the authenticated caller. This is the IDOR pattern. Look for any query that uses a user-supplied ID without a corresponding ownership check.

3. Are vertical privilege escalations blocked? If the function has role-based behavior (admin vs. user), confirm the role check happens server-side. Client-supplied roles, JWT claims that are trusted without verification, and boolean flags like isAdmin passed in request bodies are common fail patterns.

4. Is the default access posture "deny"? New routes and functions should fail closed. If no explicit permission check exists, access should be denied, not allowed.