Authentication identifies the caller. Authorization decides whether that caller may perform this operation on this object. A successful session check does not establish object ownership.
This workflow follows a synthetic report endpoint. Keep its read and write operations separate: evidence of a read flaw does not establish that an update or deletion is also possible.
Before you start
- Two synthetic accounts or tenants, A and B, and a report created by A.
- The route handler, authorization helpers and the object’s ownership field where source is available.
- The intended policy for owner, non-owner, anonymous and privileged access.
Follow the steps
- Capture A’s successful request and response as the baseline. Record which exact field demonstrates access to the report body.
- Repeat the same operation as B, changing only the session. Test anonymous access separately and avoid caches that blur the identity boundary.
- Trace the server lookup. Check whether its predicate includes the current tenant or whether a later policy check rejects non-owners.
- Write a regression test for A’s success and B’s denial. Add a privileged-role case only if the product actually defines that exception.
- Review the patch and run the tests. Check alternate endpoints, nested resources and error responses for the same invariant.
Use a precise prompt
Adapt to your evidence
Review the report lookup and its callers against this policy: the session tenant must own the report. Show the authorization decision separately from authentication. If an object can cross tenants, propose a regression test and the smallest server-side fix. Identify any role exception that requires a product decision.
Verify your work
- The test proves access to the protected object, not merely a 200 response.
- A fresh non-owner session is denied after the fix while valid owner access still works.
- The server enforces the rule independently of hidden buttons, client state or unpredictable identifiers.
Bring your own evidence into a conversation and work through the next question.
Open chat