Security teams spend a lot of time deciding whether a request should be allowed. The person making that request experiences the decision through a much smaller interface: usually a status code and a sentence. This is Part 3 of Security Infrastructure in Practice, a series about what happens when security design meets production systems. A user tries to export a report and receives: 403 Forbidden The service is technically correct. It is also about to create a support ticket. “Access...