What's the Scope for Accessibility Testing?

All forms of testing require a definition of scope. Testing accessibility requires the whole web page to conform—what does this mean for security?

I will presenting "Can an Accessible Web Application be Secure?" at OWASP AppSec EU09 in Kraków next Thursday. I will be showing the following diagram, based on a similar Venn diagram by Whittaker and Thompson 2003, demonstrates how the client's requirements and what the development team intend to build always differ. But the important thing is: what the application does is something else completely:

Many security vulnerabilities occur in the area describing what the application does, but wasn't intended to do. This gets more complicated when we consider a client who wants a usable website and perhaps conforming to a particular level of Web Content Accessibility Guidelines (WCAG) 2.0 (see also Security Implications of WCAG 2.0):

What the application actually does is usually not fully known. If we want the whole web site to conform to WCAG 2.0 Level AA, what should be tested against the success criterion? The client's specified requirements, the developed product's documentation, or what the application does?

Fortunately WCAG provides information on conformance claims which states a claim can be for a single page, unless it is part of a complete process, in which every page of the process must conform at the specified level or better.

Does then a single security vulnerability (i.e. additional undocumented functionality which is also not accessible) on a web page or the process, imply it cannot conform to any conformance level of WCAG?

Therefore, methods used for security verification are necessary to have sufficient assurance of the conformance level. I believe the argument is very strong. What do you think?

Update 19th May 2009: See also Can An Accessible Web Application Be Secure? concerning my presentation at OWASP AppSec EU09.