Identity is not universal permission
Authentication concerns the identity established by verification. Authorization concerns what that identity may do. An account may read its own report without permission to edit another person’s report or administer the system.
Privilege escalation involves gaining higher capabilities than previously held. Compare effective permissions and action evidence before and after; a successful command or a page displaying “admin” does not establish control of an entire system.
Use least privilege to limit impact
Least privilege gives a principal only the capabilities needed for its task. Default denial rejects requests that are not explicitly allowed. A matrix of principals, resources and actions avoids vague rules such as allowing everything after login.
Verification needs allowed and denied actions. If a reader can read reports but cannot delete them, confirm both outcomes. Separating everyday accounts from administration limits the impact of mistakes or account misuse.
Further reading: OWASP: Authorization Cheat Sheet
Example: report readers and maintainers
A synthetic system has reader and maintainer roles. A reader may read only their own report. A maintainer may update reports but not change account roles.
Split the policy into read, write and role-management actions. Maintaining reports does not automatically require account administration. Enforce each decision at a trusted server boundary.
Conclusion: The matrix must include denied actions and verify them.
Tabletop exercise: complete a permission matrix
Use the fictional roles without changing real accounts.
- List reader, maintainer and the three actions.
- Fill allow or deny using the example, then add “reader reads someone else’s report.”
- Write one positive check and one denial check.
Expected result
Reader writes and role changes are denied. Maintainer role changes are also denied. A reader cannot read someone else’s report.
Check your work
Why does hiding a Delete button not replace server-side authorization?
Finish and clean up
Save the matrix; no permission changes require restoration.