Separate actions and record scope
| Role | View | Edit | Approve | Export |
|---|---|---|---|---|
| Requester | Own requests | Own drafts only | No | No |
| Team approver | Assigned team | Return for correction; no silent edits | Assigned team except own requests | No |
| Finance reader | Approved records | No | No | Agreed finance fields only |
| Account administrator | Account status, not request content by default | Role assignments under policy | No automatic business approval right | No business export by default |
These roles are a starting example, not an assertion about your organisation. Describe access using action plus record scope. “Administrator” is too broad if it combines account maintenance and commercial authority without an explicit decision. OWASP recommends least privilege and denial when permission has not been granted.
Test forbidden actions directly
The edit button is hidden from a reader. What further test belongs in acceptance?
Show the worked answer
Attempt the same update directly through the application request. It must be refused, with the original record unchanged. Also test access to another team’s record using a known synthetic ID.
Retest role removal and temporary delegation expiry. Record the approved policy version beside the tests, so a policy change is distinguishable from a software defect.