Authorization can differ between a list endpoint, an object detail view and a generated export. Use two approved tenants to follow the same object across those linked requests, including any asynchronous job or download step.
01 / Define the identities and the boundary
Create or identify controlled objects in each approved tenant. Record the expected owner, role, relevant endpoints and allowed mutations. Include the list, detail, export and job-status operations that form the workflow.
Keep the scope and exclusions visible in the session. Scope warnings are advisory; the approved testing boundaries still need to guide each request.
02 / Compare related requests with clear controls
Use HTTP Repeater to retain the method, URL, headers and body for the authorised sequence. Then compare access with the second approved identity while keeping the target object and operation clear.
Does filtering in the list also protect direct object access? If an export creates a job, who can poll its status or retrieve its output? Examine the ownership check at each step instead of assuming one endpoint protects the whole chain.
03 / Preserve proof and the conditions it depends on
Retain the two account contexts, object ownership and complete request sequence. Pair the successful owner control with the contrasting result and the relevant output or artifact.
Use the finding record and available proof or artifact exports to explain the effect: which object or operation crossed which boundary, under what conditions.
04 / Test the original condition after remediation
Repeat the list-to-detail or export-to-download sequence after remediation. Confirm that the rightful owner can still use it and that each alternate account path is checked consistently.
Record the retest against the original finding and include the final impact step. Plan credits apply to testing and retesting.
Questions to resolve before the review
- Who owns the test object and which identities should access it?
- Which request establishes the control, and which shows the boundary failure?
- Does the retest cover the impact as well as the entry point?
