An access check is the decision point that verifies whether a user, session, or process is allowed to perform an action or reach a resource. It compares the request against policy: identity, role, object ownership, path, token claims, or server-side rules. In secure software, access checks must happen every time a sensitive operation is requested, not just when a user first logs in.
In cyber security, weak access checks are a common cause of authorization bugs such as broken access control, privilege escalation, and unauthorized file reads or writes. Attackers look for missing, bypassed, or inconsistent checks in web routes, APIs, and file handlers. Defenders reduce risk by enforcing checks on the server side, failing closed, and testing edge cases like alternate URLs, direct object references, expired sessions, and role changes. In systems that manage files or administrative actions, a single missed access check can turn a normal interface into a high-impact entry point.