Check who can access what

Authorization Verification

When to Use

Use when writing tests for or reviewing any role, permission, ownership rule, field mask, delegation grant, or approval workflow.

Combinatorial Policy Test Matrix

A test that only verifies admin can perform an action and guest gets 403 leaves the actual business rules untested. Derive test cases systematically from the cartesian boundary of (Actor Role & Relationship) × (Resource State & Value) × (Operation):

1. Required Positive & Negative Test Cases

For every protected operation, assert both authorized allow and unauthorized deny across:

1. Role & Ownership Boundaries:
   • Resource owner vs. non-owner peer in the same department.
   • Department/team manager of the owner vs. manager of a different department.
   • Read-only viewer/auditor vs. active editor.
   • Cross-tenant user (member of Workspace B targeting a resource in Workspace A $\rightarrow$ must return 404 without leaking existence).
2. Resource Lifecycle State Boundaries:
   • Action allowed in draft state (edit, delete) $\rightarrow$ must be denied once the resource transitions to submitted, approved, fulfilled, or locked.
3. Threshold & Separation-of-Duties (SoD) Boundaries:
   • Value just below threshold (9,999.99) vs. at/above threshold (10,000.00).
   • Self-Approval Attempt: The creator/requester of a request (even if they hold a manager or approver role!) attempts to approve their own request $\rightarrow$ must be denied.
4. Tampered / Stale Approval & TOCTOU Attempts:
   • Modify a critical parameter (price, discount, recipient, bank account, quantity) on a request after it was approved, or submit an approval against a stale version / payload hash $\rightarrow$ must invalidate the approval or reject the commit.

2. Verify Side-Channel & Collection Enforcement

• List, Search, Count & Export Parity:
  • Seed 3 records: one owned by the actor, one in another department (forbidden), and one in another tenant (forbidden).
  • Assert that list, search, count/aggregate, and export return only the 1 permitted record and do not leak the existence or field values of the forbidden records in error messages or facet counts.
• Field-Level Redaction & Mass-Assignment Protection:
  • Assert that restricted fields (cost_price, internal_margin, ssn, approver_notes, role, status) are omitted from JSON responses for unauthorized roles and rejected/ignored when injected into POST/PATCH payloads.
• Delegation & Revocation Expiry:
  • Advance the test clock past expires_at (or revoke the grant/role) and assert that immediate subsequent calls and queued delayed actions are rejected.