QA Fundamentals · Senior · Question 37 of 76
How do you test authorization thoroughly in a multi-role system?
- 1Test only with an admin account, which can do everything
- 2Build a role-by-action matrix and test allowed and denied cases
- 3Check that menus hide buttons for restricted users
Show the answer
Correct answer: Build a role-by-action matrix and test allowed and denied cases
Explanation
A matrix of roles × resources × actions makes gaps visible. Denied cases matter most, and must be checked at the API, not only in the UI.