“The action, the function is defined And the function should be only allowed according to a specific role and not to anyone.”

Transcript evidence from Erez Yalon — The OWASP API Security Project.