Direct answer
Function-level authorization controls whether a caller may invoke an operation such as creating users or exporting a tenant. Hiding an administrative button does not prevent a direct API request.
Map roles and functions
List normal, support and administrator roles and write the intended permission for each operation. Include administrative actions in API documentation, browser traffic, background jobs and alternate versions. Obtain dedicated test identities with known roles.
Reference: OWASP API5: Broken Function Level Authorization.
Test a controlled operation
Create an isolated test workspace. Capture an allowed administrator request for a harmless action, then invoke the same operation with a lower-privilege test account. Compare responses and inspect whether any state actually changed.
- Use reversible actions and an agreed request budget.
- Record actor, role, operation and expected denial.
- Avoid real customer records or privileged invitations.
Check server-side enforcement
Review direct routes, methods and background paths separately. A gateway rule can miss an alternate path, while client-side navigation restrictions do not enforce permission at the API. Object-level access also remains necessary when a permitted function accepts an object ID.
Retest both roles
After fixing the permission boundary, repeat the lower-role denial and administrator success. Inspect audit events and confirm any legitimate delegated role still performs only its approved operations. Preserve the coverage matrix so an untested privileged route is not mistaken for a passing result.
Assessment limits
A role matrix and sampled routes may miss undocumented functions or custom permissions. A denied response does not establish that asynchronous work was not already queued.
Frequently asked questions
Is function authorization the same as object authorization?
No. One decides whether an operation is allowed; the other checks access to the specific object involved.
Can a 403 still leave a side effect?
Potentially. Verify the controlled resource and background job state instead of relying only on the status.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.