One rule
State is the data your contract keeps between calls. Access control is the rule for who can change that data.
Any function that changes important state must answer two questions: who is allowed, and what proof will show the change happened.
State needs guards
A contract is code plus data at an address. Storage stays after the transaction ends, so a bad state change stays too unless a later transaction fixes it.
Use public reads when useful, but keep writes narrow. Fees, roles, balances, owners, and status flags should not be changeable by any wallet.