4.1.6 - Verify implementation of access control design

[EnigmaRosa]

Note: this was referenced in #2033 as 4.1.7, but I have re-numbered according to what was agreed on eliminating.

I propose a new verification requirement ensuring that the access control system outlined in design documentation is what is actually implemented.

#	Description	L1	L2	L3	CWE
4.1.6	[ADDED] Verify that access controls are implemented as per the design documentation.	✓	✓	✓	284

[elarlang]

Summary from feedback and discussion from #2033. Personally, I think we don't need this requirement, but we need that proposed documentation requirement and all implementation requirements to work as a unit.

We should have all "implementation requirements" covered as other separate requirements. If the documentation says something extra than we don't have already written as separate requirement, it means we need to have this new separate requirement to address this precise technical problem, but not the abstract "check the implementation" requirement.

To achieve "check the implementation" we need to validate, are all preconditions for testing the implementation requirement are covered by the documentation requirement.

[tghosth]

Yeah I think that the consensus was that we should make sure that the other specific requirements in V4 correspond to anything mentioned in the documentation requirement and that we should not have the separate discussed in this issue thread.

Does that make sense @EnigmaRosa?

[jmanico]

I think just stating that access control policy needs to be documentation is enough, I agree this is redundant.

[EnigmaRosa]

I'm iffy on this, but I am okay nixing this.