Object-level access control is the set of rules that decides whether a user, session, or service may read or modify one specific object, such as an order, customer profile, shipment, invoice, or ticket. It is different from broad login checks: a user may be authenticated and still be blocked from accessing someone else’s record. This control is critical because many applications expose data through object IDs, and a missing check can let attackers request records they were never meant to see.
In real attacks, weak object-level controls often appear as IDOR-style problems, where changing an order number or profile ID returns another customer’s data. Defenders reduce this risk by enforcing authorization on every object access, not just at the page or API entry point. Common protections include server-side permission checks, least privilege, deny-by-default logic, and testing for cross-account access to records. Strong object-level access control helps prevent privacy leaks, fraud, and unauthorized changes to business-critical data.