Only Valid ID + Valid Password should allow access. If either or both ID and PW are incorrect, validation should fail. Decisions may also need to be made regarding things such as whether the ID and password are case sensitive; Checking that the ID has not already been used; Checking for PW restrictions such as the minimum and maximum number of characters allowed, and the requirement to use a mix of upper and lower case letters, numbers and other characters; Allowing a maximum number of incorrect attempts before blocking the user for a period of time; Allowing or preventing accented characters such as Á Ä Ç É Ê Ó Ö Ü etc to be used.