Authorization Boundary Test Builder

The problem

Existing authorization logic often lacks automated tests that prove isolation boundaries. Developers frequently rely on manual checks or surface-level unit tests that fail to catch cross-tenant data leaks, ownership bypasses, or stale permission cache regressions.

What it does

• Generates executable test files for tenant isolation, object ownership, and RBAC/ABAC boundaries.
• Builds negative test cases to verify that unauthorized requests are explicitly denied across API, service, and data layers.
• Verifies denial side effects to ensure no database mutations or events occur when access is rejected.
• Identifies gaps between intended security policy and current code implementation.
• Adds mutation-sensitive assertions that fail if specific authorization guards are removed or bypassed.

Frameworks & tools

Works with existing test suites including Jest, Vitest, Pytest, RSpec, PHPUnit, and Go testing. Supports REST, GraphQL, and background worker authorization patterns.

Why this beats prompting it yourself

This skill moves beyond simple "write a test" prompts by enforcing an evidence-based traceability model. It isolates predicates to ensure one permission check doesn't mask another's failure and maps tests to the shallowest enforcement layer for better performance.

Use cases

• Hardening tenant isolation in multi-tenant SaaS applications.
• Proving role-based access control for sensitive exports, deletes, or refunds.
• Testing service account and background job permission boundaries.
• Verifying that privilege revocation or session expiration works as intended.

Known limitations

Requires access to existing policy code or authorization middleware to build confirmed test cases. It will not invent a permission model if the policy intent is missing or contradictory.