Web Application Access Control Testing: A Defensive Review Guide
Review authorization boundaries, user roles, record ownership, and tenant isolation with a defensive security checklist.
Map roles and actions
List user roles, tenant types, sensitive actions, and data classes. Define expected permissions at the organization, project, record, and field level, including administrators, support staff, service accounts, and integrations.
Use approved test accounts
In staging or under explicit written scope, use representative low-privilege and high-privilege test accounts and synthetic data. Do not inspect real customer records or test boundaries outside the agreed authorization.
Enforce checks server-side
Authorize every sensitive request using the authenticated identity and resource policy. Hiding a button is not a security control, and unpredictable record IDs do not replace permission checks.
Check indirect paths
Review exports, search, downloads, background jobs, bulk actions, APIs, and caches. Authorization must remain correct across alternate routes and asynchronous tasks.
Retest and document
Record expected permissions, observed behavior, minimal evidence, and impact. Add automated allow/deny regression tests and verify the fix across related routes.