API Security Checklist: Test Authorization Boundaries
Test scoped API authorization across roles, object ownership and tenant boundaries. Use the expectation matrix and two-tenant drill to record allowed and denied operations, supporting evidence and endpoints still unreviewed.
