Authorization is a system, not a checkbox

Authorization testing becomes difficult when it is reduced to a list of endpoints. An API rarely exists as isolated requests. It represents users, roles, objects, actions and state transitions that together define what access is supposed to mean.

A useful security assessment therefore starts by understanding those relationships. Which identities exist? Which resources belong to whom? Which operations change state? Which actions should be restricted by ownership, role or context?

• Identify user and service identities
• Map object ownership
• Understand role boundaries
• Document state-changing actions

Many authorization weaknesses are not malformed requests. The syntax can be perfectly valid, the session can be authenticated and every field can pass validation. The security problem is that the requester should not be allowed to perform that action on that object.

This is why API security requires more than fuzzing inputs. Testing needs to compare behavior between identities and determine whether the server consistently enforces the intended relationship between actor, operation and resource.

One practical way to reason about authorization is to build a matrix. Rows represent identities or roles. Columns represent objects and operations. The expected access decision becomes explicit, which makes unexpected behavior easier to recognize.

The value of the matrix is not the document itself. The value is the discipline of defining expectations before interpreting responses.

• Same user, different object
• Different user, same object
• Lower role, privileged function
• State transition without required prerequisite

Not every inconsistent authorization response has the same impact. Reading a public profile field and modifying another organization's financial workflow are fundamentally different situations.

Technical evidence needs to be connected to the sensitivity of the resource, the action performed and the business consequence. That context is what turns a raw observation into a useful security finding.