Turn a vague access requirement into a clear permission rule, with a fictional request tracker, five proposed checks and a reusable note for your next feature.