A property services business commissioning a records portal needs more than working logins. Decide which person can perform which action on which organisation’s document. Hiding a download button is not evidence that another tenant’s document is protected.
Primary evidence and claim boundaries
OWASP recommends denying by default and checking authorisation on every request, including the specific object or function. Authentication alone is insufficient. Primary reference · Read 17 October 2026.
Filled acceptance example
Synthetic teaching scenario, not a client case, provider integration test or business result. Scroll the example table on narrow screens.
| Synthetic actor and object | Requested action | Expected policy result |
|---|---|---|
| Committee viewer / OC-A / documentA7 | Read approvedA7 | Allow only approved read |
| Same viewer / documentA7 | Delete | Deny: viewer has no delete grant |
| Same viewer / OC-B documentB2 | Read by changing URL ID | Deny: organisation mismatch |
| Former member / OC-A / A7 | Read with old browser session | Deny after membership revocation |
Practical handover procedure
- Agree actor, organisation membership, document classification and permitted actions with the data owner. Treat legal entitlement as an input requiring separate review, not a rule invented by the developer.
- Use synthetic tenants and records to exercise read, update, delete and export paths directly in an authorised test environment. Include background jobs and resource download endpoints.
- Revoke membership during the exercise and verify current policy is enforced. Keep a redacted decision log with actor role, object organisation, action and policy result.
Interpret the outcome
The same person is allowed one read and denied three other requests. A single “logged in” test would miss the differences. The matrix becomes a supplier acceptance contract, while actual permissions must be implemented server-side and reviewed by the responsible security team.
Acceptance decision
Require evidence that denied requests return no protected content, including exports and cached responses. A hidden control or an unguessable document ID cannot pass this gate.
Limits and unverified work
Synthetic defensive test plan only, not a penetration test or legal records-access decision. No real tenant record was accessed and no permissions were changed.
Download the filled bilingual acceptance record — Contains these inputs, steps, expectations and limits. This is a teaching record, not an executable integration.