A business application often has more than one entrance: a browser, an integration account, a background worker and an administrator console. Treating everything behind the firewall as trusted makes those entrances difficult to reason about.
NIST published its Zero Trust Architecture guidance in August 2020. That provides a useful starting point for revisiting the period: access decisions should not depend on network location alone.
Start with one operation
Consider an API that approves an invoice. Write down who may approve it, which organisation owns it and which state transitions are permitted. Authentication identifies the caller; the operation still needs an authorisation decision against the actual invoice.
A service account should receive only the permissions its integration needs. An administrator’s interactive credentials should not become a convenient substitute for an application identity.
Make denial observable
Record the operation, a non-sensitive resource identifier and a reason code when access is denied. Avoid logging tokens or document contents. A support engineer needs to distinguish an expired session from a missing permission without acquiring the user’s credentials.
For a first review, trace one privileged action from its HTTP endpoint to its database update. Check every route that can reach the same mutation. Fixing one path is useful only if a second path cannot bypass the decision.
Reference
NIST SP 800-207, published August 2020. These implementation suggestions are an application of the principles, not a claim of NIST certification.