A person who is allowed to view one set of records may still cause a confidentiality failure by accessing another set of records without permission.

### Why this is right Permission is specific to a resource or action. A user can have legitimate access to some information and still violate confidentiality by viewing information outside that permission. ### The concept **Confidentiality** is about limiting access and disclosure to authorized parties. It is not enough to ask whether someone has an account or can log in; the system must also restrict which information that identity can access. A user who can view their own client records, for example, should not automatically be able to view every client's records. Access controls can implement these limits by assigning permissions according to a person's role or duties. Confidentiality failures can also occur when someone learns approximate values or even the existence of sensitive information, despite not obtaining the full data. ### Terms - **Confidentiality**: Protection of data and systems from unauthorized access or disclosure. - **Access control**: Rules and mechanisms that determine which identities may use particular resources. ### Remember A valid account does not mean unlimited permission.