Authorization Testing

Purpose

Verify that authorization controls properly restrict access to resources and actions.

When to Use

• After authz implementation
• New resource/action added
• Role changes
• Security audits

Process

1. Map authorization rules
2. Test allowed access
3. Test denied access
4. Test privilege escalation
5. Test cross-user access