Context: authorization is a system property

Object-level authorization is essential, but it is only the most visible layer. Modern applications distribute decisions across gateways, application services, background workers, data stores, and third-party integrations. A request can pass one correct check and still reach a component that interprets the identity or action differently.

Testing should therefore start with a model of subjects, objects, actions, and state transitions. The question is not simply whether user A can read object B; it is whether an identity can cause any disallowed transition across the full workflow.

A boundary-oriented testing model

Identity boundaries

Compare session identity, token claims, tenant context, delegated identities, API keys, and service accounts. Look for places where the strongest identity silently replaces the initiating identity.

Object boundaries

Test identifiers in paths, request bodies, nested objects, imports, batch operations, and indirect references. Include objects that change ownership or move between organizations.

Workflow boundaries

Map valid state transitions and then call operations out of sequence. Attempt approval before review, fulfillment before payment, export after access removal, and replay after a one-time action.

Service boundaries

Follow requests as they cross internal services. Confirm that downstream components receive enough context to enforce the original policy rather than trusting network location or a gateway decision.

Building useful test cases

Create at least two users in different roles and two organizations or tenants. Record the identifiers and permissions available to each. Then test a matrix of actions across ownership, role, lifecycle state, and interface. Include asynchronous jobs and alternate interfaces such as mobile APIs, exports, or administrative endpoints.

When a weakness appears, identify the exact policy that should have applied. This turns a collection of request examples into an engineering issue the team can fix consistently.

Takeaways

  • Model authorization across identities, objects, actions, and state.
  • Test asynchronous and internal service paths, not only public endpoints.
  • Preserve the initiating user and tenant context across service boundaries.
  • Centralize policy where practical, but verify enforcement at sensitive operations.
  • Describe findings in terms of the violated rule, not only the request that exposed it.