> A correctly configured service should not attempt to access things is is not intended to access. If it has to check if it has access and act conditionally It

> A correctly configured service should not attempt to access things is is not intended to access. If it has to check if it has access and act conditionally It's normally recommended to attempt the access and handle the denial, instead of doing two separate steps (checking for access and doing the access); the later can lead to security issues (https://en.wikipedia.org/wiki/TOCTOU https://en.wikipedia.org/wiki/TOCTOU).