V8.2.1: Verify that the application ensures that function-level access is restricted to consumers with explicit permissions.
ASVS Maturity
V8.2.2
V8.2.2: Verify that the application ensures that data-specific access is restricted to consumers with explicit permissions to specific data items to mitigate insecure direct object reference (IDOR) and broken object level authorization (BOLA).
ASVS Maturity
V8.2.3
V8.2.3: Verify that the application ensures that field-level access is restricted to consumers with explicit permissions to specific fields to mitigate broken object property level authorization (BOPLA).
ASVS Maturity
V8.2.4
V8.2.4: Verify that adaptive security controls based on a consumer's environmental and contextual attributes (such as time of day, location, IP address, or device) are implemented for authentication and authorization decisions, as defined in the application's documentation. These controls must be applied when the consumer tries to start a new session and also during an existing session.