Permissions Testing
Validate role-based and attribute-based access control with Impersona.
Use this guide to validate role-based access control (RBAC) and attribute-based access control (ABAC) with Impersona.
Goals
- Verify your permission matrix matches expectations
- Confirm your middleware enforces permissions consistently
- Validate edge cases (suspended users, read-only roles, etc.)
Minimal test set
Create (or identify) users with:
- Admin: full access
- Manager: read/write within a scope
- Member: read-only or limited access
- External: no access or least-privileged access
RBAC checklist
- Admin can access all protected routes
- Manager can access scoped routes
- Member can access read-only routes
- External is denied where expected
ABAC checklist
- Permissions change based on tenant/organization
- Permissions change based on ownership
- Permissions change based on feature flags or plan
- Permissions change based on environment (staging vs prod)
Evidence to capture
- Endpoint tested
- Expected decision (allow/deny)
- Actual decision
- Any policy or role that caused a mismatch
Common failure modes
- Frontend hides UI but backend still allows access
- Backend checks roles for list views but not detail views
- Roles are cached and do not update after changes