Business Rules(Application Level), is it enough to secure access when do my application as extension

Summary:

I am finalizing an application. and in stage of making business rules. but is it enough to secure my application when it is extension to fusion.

Content (required):

Hi Experts,

Business Rules: Are they enough to secure my application when it is extended to fusion. What should I do with them in production. Do i need to do something specific for stage of live and production extension.

Do I need to customize a role in fusion to secure only access. And then depend on business rules of my application?

Version (include the version you are using, if applicable):

Release