Skip to content
SecHelixSecurity / Authorization
Canonical demonstration dataFixture

Role × object × action

Authorization should be observable, not implied.

Compare expected and recorded access across identities without mistaking hidden UI for a server-side security boundary.
authz-matrix / demo-store
Identities5 matrix roles
Objects6 fixture resources
Mismatch1 recorded anomaly
Coverage1 row unknown
Two-user verification

Expected vs observed access

Resource / actionGuestUser AUser BStaffAdmin
Order Aowned by User A
Private file Aowned by User A
Seller listing Aseller-scoped read
Refund actionmoney movement
Policy exportadmin function
Webhook replaycoverage not yet recorded
User B → Seller listing AExpected DENY · Observed ALLOW. The canonical demo records the historical boundary omission as the verified finding.
Inspect evidence
Identity test

One authenticated session is not enough.

SecHelix compares User A and User B against each other’s resources to expose BOLA, IDOR, tenant leakage, and ownership failures.

Control questions

What the verifier checks

  1. 01
    Who is the actor?session identity is resolved server-side
  2. 02
    Who owns the object?ownership is derived from stored truth
  3. 03
    What action is allowed?policy is explicit at the canonical boundary