Test API authorization across tenant boundaries
Sign-in proves identity. Object authorization decides which document that identity can read. Give the assistant two synthetic tenants and an explicit sharing rule, approve its plan, then compare actual responses with the access matrix.
Prepare my tenant isolation test →Access matrix for a private document
| Actor and object | Expected access |
|---|---|
| A reads A’s private document | allow, matching document body. |
| B reads A’s private document | deny or hide, no private fields. |
| B reads an explicitly shared document | allow only the shared fields. |
Prepare the check with your AI assistant
Sample conversation
Our SaaS hosts several companies. Help me check that one company cannot read another company’s private documents.
Assistant · Is this document private or shared by policy? Give me synthetic owners from two companies and I’ll propose the allowed and forbidden reads for your approval.
On first setup, verify the target and grant the assistant access to the intended project. Review the draft and confirm the run in your workspace.
Illustrative result and next action
After enforcing tenant ownership, repeat B’s private read and both allowed reads. A blanket denial hides the leak but breaks valid use.
Questions before you start
Does every cross-account 200 indicate IDOR?
Check the sharing policy, record ownership and response body. A deliberately shared document is a positive control.
Can I test BOLA with one token?
One identity alone cannot establish the cross-tenant control. Use two independently owned fixtures and valid identities with known access rules.
Should an unauthorized read return 403 or 404?
Either can enforce the policy. Check that the response and download URL disclose no private fields or bytes.
How do I distinguish a broken login from a fix?
Retest the owner’s successful read in the same release. If both identities fail to sign in, access isolation remains unverified.
What can a public URL show?
An external check examines the reachable surface. Private workflows require authorized access and suitable test accounts. A source-code review or expert investigation has a different scope.
Can I reuse a prepared project?
Select the verified project, review the environment and permissions, then confirm the run. Recheck fixtures if the release changed the access model.