Watch this video on YouTube
What is the correct access control method for a system with sensitive information that requires authentication and authorization for access?