Watch this video on YouTube
Who should be responsible for enforcing access rights to application data?