---
name: authorization-matrix-analysis
description: Compare controlled users, roles, tenants, objects, and operations one dimension at a time with paired evidence and negative controls.
---

# Authorization matrix analysis

## Accepted inputs

- Current authorization and scope
- Controlled accounts for each relevant role or tenant
- Owned test objects and known operations
- Baseline request references with credentials redacted

## Procedure

1. Build a matrix of identity, role, tenant, object owner, object state, operation, route, and expected decision.
2. Establish a successful owner baseline and a nonexistent-object negative control.
3. Change one dimension per test: identity, object, tenant, role, method, route, or field.
4. Record request reference, response, state before and after, and the authoritative identity observed.
5. Check alternate routes and batch operations only after a single-object gap is supported.
6. Separate readable metadata, action capability, and durable state change.

## Output artifacts

- Role-object-action matrix
- Paired baseline and mutation references
- Supported gaps, rejected leads, and untested edges

## Stop conditions

Stop at uncontrolled users or records, destructive actions, sensitive data, or any mutation whose rollback is uncertain.

## Completion gate

Complete when the result repeats with fresh owned objects, the negative control behaves differently, common confounders are rejected, and impact is limited to what was demonstrated.