title: Access control - coding to the activity
body: <p>Consider (from <a href="https://www.owasp.org/index.php/Access_Control_Cheat_Sheet" rel="nofollow" title="Access Control Cheat Sheet">https://www.owasp.org/index.php/Access_Control_Cheat_Sheet</a>):</p>
  
  <pre><code>if (AC.hasAccess(ARTICLE_EDIT)) {
    //execute activity
  }
  </code></pre>
  
  <p>This correctly implies that access control</p>
  
  <blockquote>
    <p>... policy is persisted/centralized in some way</p>
  </blockquote>
  
  <p>My question is around how best to centralise this.  </p>
  
  <p>One obvious way I can think of is to include all activities needing access control in a class - hardcoding.  I can simply call the method <code>hasAccess(ARTICLE_EDIT)</code> on this class.  This implies that whenever an activity is added to the application I need to add it to the class.</p>
  
  <p>Another way to centralise access control might be to include controlled activities in my database.  Each time I need to check access I call <code>hasAccess(ARTICLE_EDIT)</code> and this would trigger a call to my database. I would include the method in the access control model.</p>
  
  <p>Firstly, am I an the right track please?  Are there any other solutions people favour?  What might be the benefits/issues of solutions please? </p>