Which API design practice helps prevent privilege escalation by controlling access at both resource and field levels?

Which API design practice helps prevent privilege escalation by controlling access at both resource and field levels?

• A. Implement resource and field-level access control
• B. Use role-based authentication only
• C. Rely on client-side checks
• D. Encrypt all API responses

Answer: (A)

Access control must be enforced at multiple levels to prevent privilege escalation. Implementing resource and field-level access control means every API call is checked for both whether the user can access the resource and whether they are allowed to view or modify specific fields within that resource. This layered authorization blocks scenarios where a user can reach a resource but is still barred from sensitive data or actions inside it. For example, a user may be allowed to read customer records but not to see salaries, and not allowed to modify protected fields. If you only apply checks at the resource level, sensitive fields could be exposed; if you only apply field-level checks, you might still permit access to the resource itself. Other options fall short: role-based authentication verifies identity but not what they can do; client-side checks can be bypassed; encryption protects data in transit but does not enforce who can access or see fields on the server side.

Access control must be enforced at multiple levels to prevent privilege escalation. Implementing resource and field-level access control means every API call is checked for both whether the user can access the resource and whether they are allowed to view or modify specific fields within that resource. This layered authorization blocks scenarios where a user can reach a resource but is still barred from sensitive data or actions inside it. For example, a user may be allowed to read customer records but not to see salaries, and not allowed to modify protected fields. If you only apply checks at the resource level, sensitive fields could be exposed; if you only apply field-level checks, you might still permit access to the resource itself. Other options fall short: role-based authentication verifies identity but not what they can do; client-side checks can be bypassed; encryption protects data in transit but does not enforce who can access or see fields on the server side.