A7 – Ensuring function level access control