API authorization matrix
Build a role-by-action matrix across two accounts you control. Test read and write operations separately, record expected policy, and use harmless records only.
Level: intermediate
Tools: Burp Suite, Postman, spreadsheet
Pipeline
For each documented endpoint, replay the same request as Account A and Account B against records owned by those accounts; compare status, response shape, and state change.