Access decisions with a physical consequence
A shared vehicle or fleet-management system authorizes both digital access — unlocking, starting, reserving a vehicle — and, in many systems, a considerably more consequential physical capability: remote immobilization, the ability to remotely disable a vehicle's operation. This is used for recovering an unreturned vehicle, responding to reported theft, or enforcing a usage boundary, and it's one of the most consequential single capabilities such a system offers, because misusing it doesn't just deny digital access to something — it can physically strand or disable a vehicle someone is actively depending on at that moment.
This is a meaningfully different category of harm than most access-control failures produce: a wrongly denied login is an inconvenience corrected by trying again; a wrongly triggered immobilization is a real-world physical consequence for whoever's using the vehicle at the time, potentially in a location or situation where that matters considerably more than an inconvenience.
Scrutiny proportional to the physical stakes
Access to trigger immobilization needs to be at least as tightly controlled as the ordinary vehicle-access permissions it's meant to enforce, and arguably considerably more so, given how directly and immediately its misuse translates into physical consequence for a real person rather than a purely digital one. Designing this capability's authorization with the same rigor given to any other high-consequence action — approval requirements, logging, review — rather than treating it as an incidental feature of the fleet-management system, matches the actual stakes involved.