Guide
Who can read which record, written down first.
Adding access control to a live product is how data breaches happen. We write who can read which record before the first screen exists.
Write the matrix before the mock
List the kinds of user and the kinds of record. For each pair, say read, write, or never. If a cell is fuzzy, the screen is not ready.
This is slower than opening Figma. It is faster than discovering, after launch, that every support agent can export every customer.
Separate customers from each other
Each customer's data stays separated from the next. A query that forgets that clause is treated as a defect.
Payroll and payments made this habit non-negotiable on our own products. We bring it to yours even when the domain is quieter.
Log the sensitive actions
Who exported, who changed a permission, who approved a payment. If you cannot answer those after an incident, the system was not finished.