---
title: "Authorization and permission QA recipes"
description: "Check role restrictions, resource ownership and cross-tenant boundaries with paired allowed and denied application actions."
canonical_url: "https://vostride.com/agent-library/authorization.md"
md_url: "https://vostride.com/agent-library/authorization.md"
content_kind: "index"
topic: "authorization"
---

# Authorization and permission QA recipes

Check role restrictions, resource ownership and cross-tenant boundaries with paired allowed and denied application actions.

Hidden controls are only one layer. Pair UI evidence with an application-specific permission check when the acceptance criterion concerns server enforcement.

## Pages (10)

- [Verify ordinary members cannot reach administrative actions](https://vostride.com/agent-library/authorization/admin-route-access-denial.md): Check administrative navigation and direct routes as an ordinary member, including an attempted harmless fixture action and an unchanged audit record.
- [Verify bulk actions handle mixed-permission selections correctly](https://vostride.com/agent-library/authorization/bulk-action-mixed-permissions.md): Select permitted and restricted fixture records through a supported mixed-result view and verify partial or atomic handling follows the documented bulk-action contract.
- [Verify one tenant cannot read another tenant private record](https://vostride.com/agent-library/authorization/cross-tenant-record-denial.md): Use two isolated test organizations and a known private record URL to check tenant isolation across page content, navigation, and application responses.
- [Verify removed members lose access through old bookmarks](https://vostride.com/agent-library/authorization/deleted-membership-old-bookmark.md): Remove a disposable organization member while retaining a known private bookmark, then verify fresh navigation and application authorization both reject access.
- [Verify private attachments follow their parent record permissions](https://vostride.com/agent-library/authorization/private-attachment-download.md): Check download access for a permitted account and a disallowed account, including a previously generated attachment link and independent access evidence.
- [Verify resource ownership transfer updates both users permissions](https://vostride.com/agent-library/authorization/resource-owner-transfer.md): Transfer a test-owned resource between accounts and check the old and new owners against the documented post-transfer permission rules.
- [Verify search excludes records outside the current user permissions](https://vostride.com/agent-library/authorization/restricted-search-results.md): Search for a unique term shared by accessible and restricted fixture records, then verify results, counts, and previews honor the application search policy.
- [Verify a role downgrade blocks saving an already open form](https://vostride.com/agent-library/authorization/role-downgrade-open-form.md): Open an editable record as an editor, downgrade that account through test fixtures, and verify its stale form can no longer commit changes.
- [Verify revoking a public share link removes anonymous access](https://vostride.com/agent-library/authorization/share-link-revocation.md): Create a share link for a private fixture, prove anonymous access works, revoke it, and verify a fresh anonymous request no longer returns shared content.
- [Verify a viewer cannot edit a record through its direct URL](https://vostride.com/agent-library/authorization/viewer-cannot-edit-record.md): Check read-only permissions through the normal interface and a known edit destination, then inspect persistence to catch hidden unauthorized mutations.

## Apply a recipe

These are test designs to adapt to an application's acceptance criteria and fixtures. They are not recorded runs or a claim that a listed application has been tested. Use the [recipe execution guide](https://vostride.com/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md) to author, validate, run and inspect a test.

[All topics](https://vostride.com/agent-library.md)