Agent-ready workflow · api
API Authorization Matrix
Normalize roles, tenants, objects, actions, and lifecycle states into paired authorization tests.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- object ID
- tenant ID
- role-only UI
- hidden field
- mobile API
Prerequisites
- two controlled accounts
- controlled records
- operation inventory
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Normalize operations
Record method, route, schema, identity, role, tenant, object type, lifecycle state, and side effects.
Inputs
- approved API traffic
Outputs
- operation inventory
- Evidence gate
- Every mutation has a known controlled object and rollback path.
- Negative control
- Unknown operations remain read-only candidates.
- Stop condition
- Do not enumerate other users' objects.
Build role-object-action rows
Define expected allow and deny outcomes for owner, peer, lower role, other tenant, and unauthenticated states.
Inputs
- operation inventory
Outputs
- authorization matrix
- Evidence gate
- Each test changes one identity or object dimension.
- Negative control
- Nonexistent object behavior is recorded.
- Stop condition
- Use only controlled identities and records.
Run paired tests
Replay a known-good request with one changed boundary variable.
Inputs
- matrix row
- baseline request
Outputs
- paired raw evidence
- Evidence gate
- Unauthorized read or reversible write is reproducible with fresh identifiers.
- Negative control
- Original owner and expected-deny requests bracket the result.
- Stop condition
- Stop after one sufficient controlled example per operation class.
Check lifecycle consistency
Compare create, read, update, delete, export, share, restore, and bulk variants for the same object.
Inputs
- supported matrix gap
Outputs
- affected operation set
- minimal impact
- Evidence gate
- Each added operation is independently tested rather than inferred.
- Negative control
- Client-only hiding is not reported without a server-side gap.
- Stop condition
- Restore modified test data.
Related methods
Continue with the right depth.
Sources