November 17, 2023 - Security and Privacy

Check authorization on every business object

An authenticated customer should not automatically see every invoice or attachment. Define access at the business object level, then ask for evidence across screens, exports, and background work before accepting the feature.