What a support account should never see
Ten families of endpoint, all of them a venue's money, sat outside the list that is supposed to keep support staff away from financials. Hiding the menu item is not the same as closing the door.
Somebody helping a vendor with a stuck printer does not need to see that vendor's profit margin. That is not a policy we invented; it is obvious to anybody who has worked a support desk. Ours is written down plainly: support staff, no financials.
The way that gets enforced is a list of endpoint families considered financial. Reports, dashboard, vouchers, invoices, purchase orders, payouts. A support account is refused all of them.
The trouble with a list is that it only contains what somebody remembered to put in it. Every time a new area of the product ships, the list needs a line, and there is nothing to make anybody add one. We had already missed it twice and found out both times because a person happened to notice — which is luck, not a method.
Asking the router instead of reading the list
So rather than reading the list and nodding, we asked the server. Enumerate every family it serves. Run the permission check for a support account against all of them. Print what comes back yes.
Ten families were outside the list, and every one is a venue's money: profit and loss, margins, VAT, the pay run, cash, sales analytics, the revenue hub, forecasting, and the limit on how much of somebody else's money a person is allowed to commit. Three of them accepted writes.
Precisely what was exposed
Being accurate about this matters more than making it sound dramatic. The back office already hid nine of the ten from a support user's menu, and typing the address directly bounced you out. So on screen, nine of the ten were not reachable. And we have no support accounts on the live system at all — the grants were counted. Nobody was exposed.
It was still a real hole, because the whole point of that file is that the rule is enforced on the server, not in a menu. Anything that is not our own app — a script, a stale session, a future integration — goes straight past a hidden sidebar. Hiding the door is not closing it.
The tenth was different and worth naming: one screen was in neither list, so a support account could open it and read a venue's revenue on screen. Fixing only the server half would have left a visible link leading to a screen that fails to load, which is its own small insult. Both halves went together.
The rule underneath
A comment is not an enforcement. If your system has a policy about who sees money, the useful question is not whether somebody wrote it down — it is what runs when a request arrives, and whether anything would notice if a new area of the product quietly failed to join the list.