If access authorisations and approvals are not designed and assigned properly, unauthorised third parties might access data. Attackers or unauthorised users could thus change, delete, or copy data.