Permission test cases, because these defects are completely silent

Horizontal access is the gap that matters most and gets tested least. Teams check that a viewer cannot do administrator things, which is vertical, and forget that one customer reaching another customer record is the same severity and far more likely. Authenticate as one user, capture a resource identifier, request it as another, and repeat for update and delete rather than only for read.

Write paths lag read paths. A review hardens the endpoints that return data, and the update, delete, bulk and import paths keep their original permissive checks. Always test all four verbs against a resource you should not own.

Exports, search and nested resources are the three routes that bypass otherwise correct authorisation. An export builds its own query, a search index is filtered after retrieval, and an expansion parameter pulls a child record whose own permission check was never written. All three produce leaks that look impossible from the screen.

Mid session role changes are the state case worth writing down. When permissions live in a token, revoking a role does nothing until that token expires, so a demoted or dismissed user keeps working access for the remainder of its lifetime. Decide the window deliberately, document it, and test that it holds.