Requirement Q1: Unauthorised access