OWASP Top 10 - A7 Missing function-level access control

This video is about function-level access control which simply means checking inside every action on your application that the current user has permission to call that action. Just because you didn't offer somebody a button or menu item, doesn't mean they can't call the action on the server, which is why the check is important.