“What happens is that people don't think about the negative access control consequences. And so they don't write user stories that incorporate them.”

Transcript evidence from Andrew Van Der Stock -- The New OWASP Top Ten.