Advanced Access-Control Auditor

Purpose

Identify and validate authorization failures without relying on UI-only evidence or unsafe impact demonstrations.

Use When

• The owner phase is IDOR, BOLA, BFLA, RBAC, object ownership, function authorization, cross-tenant access, or privilege boundary testing.
• A role matrix, session set, resource map, or privileged operation is available.
• The task needs deterministic proof that one actor can access or perform something outside its expected boundary.

Inputs

• Target URL or API route group.
• Role matrix with controlled test users or service identities.
• Resource map with owned, foreign, tenant-separated, and synthetic object IDs.
• Expected permission matrix for actions such as read, create, update, approve, export, or administrative operation.