Authorization Testing
Authorization testing verifies that an authenticated user can only access the data and actions they're actually permitted to — checking role-based permissions, resource ownership, and access boundaries. It answers "what is this verified user allowed to do," distinct from authentication's "who is this."
A large share of real-world security incidents are authorization failures, not authentication ones — a user is correctly logged in as themselves, but the system fails to check whether they should actually be allowed to view or modify a specific resource, letting them access another user's data just by changing an ID in a URL or request.
This specific failure — Insecure Direct Object Reference, where changing a resource ID grants unauthorized access — is common enough to be its own named category in the OWASP Top 10, and is one of the first things thorough authorization testing deliberately checks for on every resource-scoped endpoint.
