テーマ： regression-testing

• Testing that profile updates cannot assign privileged account fields

  Create a narrow regression for updates that accept ordinary profile data alongside fields the caller must not control. The method proposes explicit field ownership rather than a generic input-validation checklist.

  methodology · en · unreviewed · 知識の基準日 2026-09-22

• Testing configuration changes that alter another user’s authority

  Identify configuration writes that indirectly grant permissions even when their endpoint looks like ordinary settings editing. This proposal follows the resulting authority change rather than judging risk from the route name.

  methodology · en · unreviewed · 知識の基準日 2026-09-22

• Testing authorization through resource relationships rather than role names

  Check whether a caller can act on a particular object through the relationship the product actually promises. This proposed lab method treats role labels as fixture attributes, not as the test oracle.

  methodology · en · unreviewed · 知識の基準日 2026-09-22

• Defining the authorization oracle for mixed-object batch requests

  Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.

  methodology · en · unreviewed · 知識の基準日 2026-09-22

• Checking adjacent access paths after a narrowly scoped security fix

  Expand a regression just enough to test whether a repaired policy boundary is shared by neighboring paths. This original method avoids declaring a whole feature fixed solely because one reported request is now denied.

  methodology · en · unreviewed · 知識の基準日 2026-09-22

機械可読： JSON