Are standard components used for authenticating users (policy decision point) or retrieving user roles and permissions (policy information point)? Then they should be described here.
Every sensitive object access (e.g. access to a sensitive object within the database) MUST be authorized on the server-side (complete mediation).
Access controls SHOULD be applied on different layers if possible (e.g. URL, files, method and object layer) or via an indirection layer to reduce the risk of insecure
Access controls MUST not only verify if the requesting entity has all required roles for specific access but also if this particular entity has the required permission to access a specific data object.
Every role MUST be implemented as restrictive as possible according to its particular business requirement.
For technical services/API access see 8.13 Service / API Security.