Direct answer
A useful authorization fixture makes ownership, role and intended sharing explicit. Two accounts alone are insufficient if the tester cannot tell who owns a record or which collaboration is allowed.
Write the expected policy
Choose a realistic action such as reading or exporting an invoice. Document which tenant, owner, role and collaborator may perform it, including a denied example. Agree boundaries and exclusions with the application owner.
Reference: OWASP Authorization Cheat Sheet.
Create labeled synthetic data
Provision at least two isolated users and separate records with recognizable harmless values. Add a deliberately shared record where sharing exists. Avoid customer data, payment operations and real notifications; record how to reset the fixture.
- Use dedicated role-specific accounts.
- Label records with expected owners and permissions.
- Keep credentials in the approved secret store.
Run positive and negative controls
Verify each account can access its own record, an approved collaborator can access the shared record, and an unrelated account is denied. Inspect content and state rather than treating the status alone as the outcome. Repeat each action and alternate route in scope.
Maintain reproducibility
Record environment, role, object ID, request and expected result with secrets redacted. Recreate or reset fixtures before retesting and note unavailable paths or policy changes so later results remain comparable. Remove test data after the engagement using the owner's agreed cleanup process.
Assessment limits
A fixture models the agreed policy and does not prove every combination of user, tenant and object. Production policy may differ from staging and requires separate verification.
Frequently asked questions
Why include a shared record?
It checks that a fix does not deny legitimate collaboration while restricting unrelated users.
Does a 200 status prove unauthorized access?
No. Verify the protected test record or state actually returned and compare it with the documented policy.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.