4. of Tampering I

Your code makes access control decisions all over the place, rather than with a security kernel:

Threat
	You haven’t centralized your access control and in different areas of your application, the checks against roles are hard-coded. So, if you change the roles later, you have to remember to make the changes in all the different parts of the system.
CAPEC	CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-1: Accessing Functionality Not Properly Constrained by Access Control Lists (ACLs)
ASVS	1.4.4: Ensure the use of a security kernel to manage access control
CWE	CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-266: Incorrect Privilege...