Access security best practices

[vstarush]

Hello,

I have a couple of questions on the best practices for access management:

1. What is the best way to restrict creation/update of a collection document to only local API?
2. What is the best way to restrict read access to payload api from to only restricted domains?
   For example, I am using the payload.config whitelisting of domains via cors, but then if I just hit in the browser "http://backend/api/collection" I am still getting all the data. The idea is to restrict this to only work when a request is coming from a specific client domain and that it.

Would apprecialte any help and feedback!

Thank you!