Mesteriis Authz Boundary Review
Review access-control boundaries as behavior, not style.
Workflow
- Identify actors, roles, tenants, objects, and privileged actions.
- Trace request/input to authorization decision and data access.
- Check object ownership, tenant scoping, bulk operations, admin bypasses, background jobs, and indirect object references.
- Validate with tests or concrete code evidence.
- Report exploit path and minimal fix.
Output
- affected boundary
- attacker capability
- missing or weak control
- exploit path
- files and lines
- regression test suggestion
Rule
Do not accept UI-only hiding as authorization. The enforcing control must exist on the server or trusted boundary.