] "Explicit Authorization. A user's authorities must only
] be provided to other actors as a result of an explicit
] user action that is understood to imply granting. "

Marking this for my own later reference.

Secure Interaction Design