Ensure that access control checks are performed related to the business logic. These
checks may be different than the access control checks that are applied to more generic
resources such as files, connections, processes, memory, and database records. For
example, a database may restrict access for medical records to a specific database user,