“You have to have an access control approach or design and then you have to implement that throughout your application.”

Transcript evidence from Chris and Robert -- Controversy within the OWASP Top 10 RC.