Run Authorization Regression in CI
Keep allowed and denied tenant access tests in the release pipeline.
A one-time access review can find a defect, but a later route change can restore it. Put stable authorization cases in CI so each build checks the decisions the product depends on. The OWASP Authorization Regression Testing Cheat Sheet supports repeatable tests built from a permission matrix.
CI fixture plan
Start with two synthetic tenants, several roles, one intentionally public object, and one revoked member. Link each test to a named policy row and route.
| Test class | Example assertion |
|---|---|
| Allowed path | A member reads A's approved record fields |
| Cross-tenant denial | A member cannot read B's private record |
| Function denial | Member cannot use tenant admin action |
| Property denial | Member cannot change protected owner field |
| Legitimate public path | Anonymous user reads public view only |
| Revocation | Former member loses A access under stated rule |
A test suite that only checks denials can pass when the feature is broken for everyone. Include legitimate access controls. For denied writes, inspect database and queue state, not just response status. Keep fixture data stable and clearly artificial.
Keep the gate trustworthy
Run the tests against the same policy and routing layer used by the app. A unit test of a helper does not prove every handler calls it. Track coverage by route and action. When a route is added or its method changes, require a new policy row or an explicit public classification. Save failure output without printing tokens or customer data.
The OWASP ASVS gives a wider verification frame. This CI plan is narrower: it protects known tenant and API decisions. It does not replace a scoped human review of new architecture. If an access test is flaky, investigate the fixture or asynchronous state instead of disabling it. A skipped denial test leaves a known gap that the release owner should see.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.