# Authorization Testing

Application-level authorization methodology - horizontal, vertical, and tenant boundary...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill authorization-testing -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill authorization-testing -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill authorization-testing -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill authorization-testing -g -a gemini-cli -y`

## Description

Application-level authorization methodology - horizontal, vertical, and tenant boundary testing, ownership transitions, method and route differentials. Replay legitimate privileged requests with lower privilege using authz_matrix first to produce differential evidence.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Authorization Testing

## Purpose

Test whether the application enforces WHO may do WHAT to WHICH object - at every boundary: same-level users (horizontal), privilege levels (vertical), tenants (organizational), and lifecycle states (ownership transitions). This is the methodology layer: it decides which pairs to replay and what counts as proof.

## Entry Conditions

- Any object-id parameter (/api/orders/1042), tenant header, or role-differentiated route is observed
- You hold accounts at two or more privilege levels, or two accounts in different tenants

## Core Strategy: Replay the Legitimate Request, Change Only the Identity

1. Perform the operation legitimately as the owner/rightful role (capture the exact request) - this is the **baseline**
2. Replay the identical request with a lower-privilege or different-identity context
3. Compare: status AND body AND effect on the object
4. **authz_matrix FIRST**: authz_matrix url=<resource> replays your request as the second configured account and as anonymous, then records the cross-identity access differential as exploit-proven ledger evidence. Do not hand-roll multi-account curl comparisons when authz_matrix settles it in one call.

## Boundary Classes

### Horizontal (user -> other user objects)
- A requests B objects across every resource type: profile, orders, messages, documents, settings, payment methods
- Both directions (A->B and B->A); write operations (PUT/DELETE), not just reads
- Confirm the returned data genuinely belongs to the other principal (match IDs/names/emails) - not a benign echo

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/application-security/authorization-testing/SKILL.md