aegis-authz-access-control

Scope & Objectives

Scan for authorization failures: code decides wrongly who may call an action (BFLA, vertical escalation) and which object instances an action may touch (BOLA/IDOR, horizontal escalation).

In scope:

• Missing or incorrect role/permission checks on routes, handlers, resolvers, controllers.
• Object fetches keyed by request-supplied IDs without ownership/tenant predicates.
• Multi-tenant isolation gaps (tenant context from input, shared caches/queues/indexes).
• Authorization logic bugs: deny-by-absence, OR-condition typos, verb tampering.
• Path normalization and proxy-header bypasses (X-Original-URL, X-Forwarded-For trust).
• Impersonation/API-key/service-trust features without scoping or audit.

Out of scope (other modules): authentication strength, session fixation, injection, SSRF, crypto. Only audit post-authentication decision logic here; flag unauthenticated reachability of privileged actions as BFLA.

Prerequisites & Vocabulary

Zero-background primer: the terms this module uses, one line each. Deeper plain-language explanations for every class live in the repository GUIDE.md glossary.