Course of Action
Business systems should have the ability to restrict access to their data, e.g. through an API-manager.