Role and permission scenarios

Tests permissions across personas, record ownership and membership changes, including indirect data surfaces.

roles-permission-scenarios

Team members using this skill

AgentNova

See how it helps

When is it useful?

Use when hiding buttons alone does not prove access control.

What does it help you do?

Builds allowed and denied action matrices by role and context.
Checks direct server requests and mid-session revocation.
Verifies lists, exports and notifications follow the same boundaries.

Try asking this

Test a removed team member's open browser tab, direct record URL and pending export request. Revoke membership after the export is queued. Direct reads must fail and execution must recheck authorization before producing or delivering the export.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Roles & Permission Scenarios

A feature is not verified if it was only tested with a super-admin or owner account. Permissions, role transitions, and workspace boundaries must be checked across representative personas.

Workflow

Build a role & persona test matrix:
- Select the relevant actors for the workflow:
  - Unauthenticated / Expired session: Logged-out user or revoked token.
  - Restricted / Read-only viewer: Can view permitted records but cannot create, edit, approve, or delete.
  - Standard member / Collaborator: Can act on own or assigned items, subject to ownership or approval rules.
  - Approver / Manager / Admin / Owner: Can configure, approve, or manage workspace members.
  - Cross-tenant / Outsider user: Authenticated user belonging to a different workspace or project.
Verify both UI affordances and server-side enforcement:
- UI layer: Restricted actions should be hidden or clearly disabled with an explanation so authorized vs. unauthorized capabilities are obvious.
- API / Server layer: Never trust hidden buttons alone. Verify that calling the API endpoint directly with a viewer's or outsider's credentials returns 403 Forbidden (or 404 Not Found across tenants) and mutates zero data.
Test mid-session role and membership changes:
- Check what happens when a user's role is downgraded, their membership is revoked, or an item is reassigned while they already have the page or form open.
Verify filtered lists, exports, and notifications:
- Confirm that restricted fields or records excluded from a user's detail view do not leak through list summaries, search results, CSV exports, activity feeds, or webhook notifications.
- Hand complex policy-engine or RBAC/ABAC architecture findings to the authorization and multi-tenant specialists.

Included files 1

SKILL.md