Translate clinical tasks into minimum permissions
Least privilege means granting users and services only the authorisations they need to perform assigned functions. Begin with concrete tasks, such as scheduling an assessment, viewing a returned result, exporting a report, administering a workspace, or supporting a technical incident. [1]
- Define permitted actions and data scope separately. Permission to view a result should not imply access to every clinic or patient.
- Separate routine clinical work, workspace administration, billing, integration management, and supplier support.
- Use time-limited elevation for exceptional access and require a reason where practical.
- Remove access promptly when duties, organisation membership, or service integrations change.
Enforce authorisation at the API and object boundary
Interface controls do not provide an authorisation boundary. Each request must establish identity, permitted operation, tenant or organisation scope, and access to the specific object. OWASP identifies broken object-level and function-level authorisation among the leading API security risks. [2]
- Deny by default and validate authorisation server-side on every request.
- Use distinct service identities and narrowly scoped credentials for integrations.
- Constrain token audience, lifetime, scopes, and storage; plan revocation and rotation.
- Apply rate, resource, and payload limits appropriate to the endpoint and failure impact.
- Test cross-tenant identifiers, guessed object identifiers, altered functions, expired tokens, and repeated requests.
The access evidence loop
A five-step control loop from clinical task to tested and reviewable access.
- Define task
Name the person or service task and required data scope.
- Grant minimum
Issue the narrowest role, credential, and duration that supports it.
- Enforce boundary
Authorise every operation and object at the server boundary.
- Record event
Create protected, proportionate evidence of security-relevant actions.
- Test and review
Exercise denied paths and remove unnecessary access.
Record an audit trail that can answer real questions
Security logging should support detection, investigation, accountability, and recovery. For sensitive assessment workflows, useful events may include authentication, permission changes, scheduling, result access, exports, integration configuration, support elevation, and administrative deletion actions. [3]
- Record who or what acted, the organisation scope, action, affected resource reference, outcome, timestamp, and correlation identifier.
- Avoid putting assessment answers, secrets, access tokens, or unnecessary personal data in logs.
- Protect logs from unauthorised access and alteration, synchronise time, define retention, and monitor collection failures.
- Make high-impact events reviewable without requiring unrestricted database access.
Verify both allowed and denied paths
- Create a permission matrix from real tasks and test every role against it.
- Attempt cross-organisation, cross-patient, and unauthorised function access using synthetic test data.
- Trace high-impact actions from request through audit record and alert handling.
- Review dormant accounts, service credentials, broad roles, and exceptional access on a defined schedule.
- Retest after changes to endpoints, role definitions, identity providers, integrations, and support procedures.
Sources and further reading
- Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Rev. 5 (opens in a new tab)National Institute of Standards and Technology. Published 2020-09-23. Updated 2020-12-10. Accessed 2026-07-13. US government control catalogue covering least privilege, account management, access enforcement, audit events, and log protection. It is not a certification of any product.
- OWASP API Security Top 10 - 2023 (opens in a new tab)OWASP Foundation. Accessed 2026-07-13. Community security guidance on common API risks including object-level and function-level authorisation, authentication, resource consumption, and inventory management.
- Introduction to logging for security purposes (opens in a new tab)UK National Cyber Security Centre. Accessed 2026-07-13. UK government guidance on useful security logging, log collection, protection, retention, and review.