# Authorization test worksheet

Project: __________  Environment: __________  App version: __________

Tester: __________  Date: __________  Authorized scope: __________

Use test account labels and synthetic record aliases here, not credentials or customer data.

## Intended rule

Resource: __________

Who owns it? __________

Who else should have access, for which operations, and why? __________

What should happen when membership, role, or sharing permission is revoked? __________

## Expected and observed behavior

Fill in expected access before making requests. An expected denial only counts when the corresponding allowed operation works with a known fixture.

| Actor | Operation and synthetic target | Expected access | Positive control | Observed result / state change | Verdict |
| --- | --- | --- | --- | --- | --- |
| Owner A | Read record A | Allow | Exact fixture and owner match | | |
| Owner B | Read record B | Allow | Exact fixture and owner match | | |
| User B | Read record A | Deny for individual private records | Owner A can read A | | |
| User A | Read record B | Deny for individual private records | Owner B can read B | | |
| Signed out | Read A and B | Deny for private records | Both owner reads work | | |
| User B | Update disposable A record | Define for product | Owner update works | Check affected rows and final state | |
| User B | Delete disposable A record | Define for product | Owner delete works on separate fixture | Verify target still exists | |
| User B | Insert record claiming owner A | Define for product | Valid B-owned insert works | Verify no unauthorized row was created | |
| Allowed teammate | Read shared record | Define for product | Sharing was actually granted | | |
| Unrelated tenant | Read shared record | Deny unless intentionally public | Allowed teammate can read | | |
| Former member | Read after membership revoked | Define for product | Access worked before revocation | | |

The supplied script covers only the first five rows' read requests on its fixture. The remaining rows are a manual/adapted test plan.

## Coverage beyond the table

Record separate tests for storage objects, signed download links, application endpoints, RPCs, edge functions, exports and realtime subscriptions where the product exposes them. A table result does not establish that those paths enforce the same rule.

## Outcome

- PASS: expected behavior observed and positive control succeeded.
- EXPOSED: unintended access or state change observed.
- INCONCLUSIVE: authentication, fixture, request or evidence was inadequate.
- NOT TESTED: outside this run's scope.

Finding reference: __________  Fix reference: __________  Retest date/result: __________