Design the authorization model

You might need to iterate between these steps, refining your requirements, as you define your model.