Authorization test planner
A permission rule.
A reviewable test matrix.
Choose a sample policy and generate permitted and denied cases for an authorized manual assessment. This tool does not execute requests or discover vulnerabilities.
Built by Abdullah Bin Zarshaid for the community. Free to use; no account, AI API or upload.
Start with the real policy.
The presets below are examples, not universal security rules. Confirm the application owner's intended permissions and obtain written testing authorization. Use only synthetic accounts and records.
Planned cases, not executed results.
| Actor | Relationship | Action | Expected | Validation focus |
|---|
Check the actual data returned and state changed, not only the HTTP status. Include alternate endpoints, background effects and a permitted positive control. Keep requests and evidence in an approved private location.