Access Control in Depth

Access control is the single most reported class of bug. This path takes it seriously — from a decremented id to mass assignment to climbing roles — and finishes on a chain that turns two small gaps into a full account read.