Permission Boundary Test Skill

Discovery

Before writing tests, map:

• Resource inventory — every entity with an owner (users, documents, orders, invoices, etc.)
• Access patterns — which HTTP methods and routes touch each resource (GET, PUT, PATCH, DELETE, and non-REST actions like /share, /export, /duplicate)
• Role model — flat ownership only, or RBAC with roles (admin, member, viewer)? Org/tenant hierarchy?
• ID type — sequential integers are trivially enumerable; UUIDs reduce but don't eliminate IDOR risk
• Indirect access paths — can resource B be reached by manipulating resource A? (e.g. a comment endpoint that exposes its parent post's content)

The Two User Pattern

Every permission boundary test needs exactly two authenticated users. Never test with one user and an anonymous request — that tests authentication, not authorization: