DEV Community

Cover image for Broken Access Control: Who Actually Deserves Your Time?
Khali Sollis
Khali Sollis

Posted on

Broken Access Control: Who Actually Deserves Your Time?

How unrestricted emotional access creates instability, why familiarity is often mistaken for permission, and what changes when access becomes intentional instead of automatic

After implementing rate limiting and protecting cognitive bandwidth, another structural issue became visible:

I still granted too much access.

Not only to my time.

To my attention.
My emotional availability.
My internal space.

The old system operated under an unspoken assumption:

If someone exists in my life
→ they automatically receive access

No verification process.
No permission layers.
No reassessment logic.

And eventually, the system became crowded with people who had access to resources they never learned to respect.

The Bug: Broken Access Control

In security systems, broken access control happens when permissions are granted too broadly or maintained long after they should have been revoked.

The result:

boundary violations
resource misuse
system instability

Human systems behave similarly.

When access is automatic instead of intentional:

emotional energy gets overconsumed
boundaries become unclear
relationships lose proportionality

Everyone receives high-level permissions regardless of demonstrated behavior.

Familiarity Is Not Qualification

One difficult realization:

History and access are not the same thing.

Someone knowing you for a long time does not automatically mean they deserve unrestricted proximity to your life.

But my old system confused:

time investment
emotional history
past closeness

with permanent authorization.

Which created this flawed logic:

Known person
→ trusted person
→ permanent access granted

Even when current behavior no longer supported that level of trust.

The Problem With Default Permissions

When boundaries are unclear, people often operate at the highest level of access available.

Not always maliciously.

Simply because the system allows it.

Examples:

expecting immediate emotional processing access
assuming unrestricted availability
crossing conversational boundaries
demanding explanations for personal decisions

And because I rarely enforced limits, those permissions became normalized.

Emotional Infrastructure Misuse

At some point, I realized something uncomfortable:

I had become emotional infrastructure for people who contributed very little stability in return.

The system looked like this:

My availability
→ their convenience
My emotional labor
→ their regulation
My attention
→ their access point

Meanwhile:

my recovery time increased
my focus fragmented
my internal clarity decreased

The system wasn’t balanced.

It was extractive.

Why Revoking Access Feels Difficult

Because many of us were conditioned to associate access restriction with cruelty.

Old emotional equation:

Boundary = rejection
Reduced access = punishment

So instead of recalibrating permissions, the system tolerated increasing misalignment.

Even when:

respect diminished
reciprocity disappeared
exhaustion accumulated
The Identity Layer

Part of my resistance came from identity maintenance.

I wanted to be perceived as:

open
generous
emotionally available
understanding

Which meant I often prioritized preserving accessibility over protecting stability.

But systems without access control eventually become vulnerable to overload.

Not because everyone is malicious.

Because unrestricted access scales badly.

The Difference Between Connection and Access

This distinction changed everything.

Someone can:

know you
like you
care about you

without requiring unrestricted access to:

your time
your nervous system
your attention
your emotional processing capacity

Connection does not automatically equal entitlement.

The Fix: Permission-Based Access

I stopped treating access as automatic.

I started treating it as earned, maintained, and adjustable.

  1. Reevaluate Existing Permissions

Old model:

Access granted once
→ permanent authorization

Updated model:

Access requires ongoing alignment

Respect became a maintenance requirement.

  1. Introduce Permission Levels

Not everyone receives the same degree of access.

Some relationships became:

close but limited
warm but bounded
supportive but structured

The system stopped operating in extremes.

  1. Stop Over-Explaining Boundaries

One important shift:

I no longer needed universal approval for access restrictions.

A simple:

“I’m unavailable for that.”

became sufficient.

No extended justification layer required.

  1. Normalize Access Revocation

If repeated behavior demonstrated:

disrespect
instability
entitlement
emotional extraction

permissions changed.

Not vindictively.

Accurately.

What Changed

After implementing intentional access control:

emotional exhaustion decreased
focus improved
resentment dropped significantly
relationships became more balanced

And unexpectedly:

The people capable of respecting boundaries stayed.

The ones dependent on unrestricted access struggled the most.

That distinction became valuable data.

Reframing Availability

Old model:

Being good = staying accessible

Updated model:

Healthy systems regulate access
Takeaway

Not everyone who enters your life deserves unrestricted access to your time, energy, or emotional bandwidth.

Access is not proof of love.

And removing access is not automatically cruelty.

Sometimes it’s system maintenance.

Because when access control is broken, self-respect eventually becomes compromised infrastructure.

Status
Default permissions: removed
Access control protocols: active
System integrity: stabilizing
Series: Behavioral Anti-Patterns

Previous: No Rate Limiting: How Instant Availability Destroys Focus
Next: From Approval-Seeking to System Integrity: Shipping a New Version of Yourself

Top comments (2)

Collapse
 
usernameinvalid profile image
Larry Z. •

This is a sharp extension of the systems metaphor, especially the idea that access and connection are not the same thing. The security framing makes an often-emotional boundary issue much easier to examine objectively: permissions can become outdated, overly broad, or simply misaligned with the current relationship.

A few ideas especially stood out:

  • “If someone exists in my life → they automatically receive access” is such an easy default to fall into. But proximity doesn't necessarily justify unrestricted access to someone's time, attention, or emotional capacity.

  • Familiarity isn't qualification. Knowing someone for years can create history and closeness, but it doesn't automatically guarantee that the same level of access remains appropriate indefinitely.

  • Default permissions create predictable problems. When availability is unlimited and boundaries aren't enforced, people can reasonably begin treating that access as normal—even without consciously intending to take advantage of it.

  • Emotional infrastructure is a powerful concept. Becoming the person others routinely rely on for regulation, reassurance, processing, or problem-solving can create an invisible resource drain that isn't always recognized until exhaustion appears.

  • Access control isn't necessarily about distrust. It's about proportionality. Different relationships can have different levels of access without requiring hostility, rejection, or emotional distance.

  • “Connection does not automatically equal entitlement.” This may be the most important distinction in the piece. Caring about someone doesn't require unlimited availability, and closeness doesn't eliminate the need for boundaries.

  • Permission can be dynamic. The idea that access should be “earned, maintained, and adjustable” challenges the assumption that one-time trust creates permanent authorization.

  • Over-explaining boundaries can become another form of seeking permission. A simple “I'm unavailable for that” can sometimes be enough. A boundary doesn't necessarily become more legitimate because it comes with a lengthy justification.

  • Revoking access can be information, not punishment. When repeated disrespect or entitlement changes someone's level of access, the adjustment can simply reflect what the relationship is currently demonstrating.

  • Healthy boundaries can reveal reciprocity. People who respect reasonable limits can continue relating within them, while relationships that depended on unrestricted access may become strained. That difference itself provides useful information.

The broader takeaway is that availability is a resource, not a moral obligation.

You can be warm without being perpetually accessible. You can care without providing unlimited emotional bandwidth. You can maintain connection while changing the permissions around that connection.

The strongest line for me is: “Healthy systems regulate access.”

Sometimes protecting your time and emotional capacity isn't closing the door on people.

It's simply deciding which doors should have locks, which should stay open, and who gets a key.

Collapse
 
mona_d_4222dda374567263b profile image
Mona D. •

A must read worth sharing! Thank you so much for this DEEP reflection!