Access Control Testing

This guide treats application authorization and tenant isolation controls as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Create designated identities for each role and tenant.

2. 02

   Create synthetic objects owned by each test identity.

3. 03

   Map actions, objects, fields, lifecycle states, and administrative functions.

4. 04

   Capture one legitimate baseline request for every matrix cell.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Change one object, tenant, role, function, or field boundary at a time.

2. 02

   Confirm both UI and direct API paths enforce the same policy.

3. 03

   Test bulk, export, search, and background-job paths.

4. 04

   Stop after synthetic evidence proves the decision error.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log denied authorization decisions with identity, object type, and policy outcome.
• Alert on repeated cross-tenant and administrative denials.
• Avoid placing sensitive object contents in audit logs.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Enforce authorization server-side on every request.
• Centralize policy and default to deny.
• Use immutable tenant context and indirect object references only as defense in depth.
• Add negative authorization tests to CI.