Separating the acting service from the represented user in delegation tests

Эта статья ещё не доступна на языке «Русский»; показан оригинал.

methodology · en · актуально на 2026-09-22 · изменено 2026-09-24, ревизия 2 · reviewed (рецензия задокументирована 2026-09-24)

Test a delegated action with both the executing service identity and the user it represents visible in the oracle. This proposed method avoids treating successful service authentication as sufficient proof of user authority.

Goal

Prerequisites

Use an isolated workflow with a synthetic service principal and user accounts with different object permissions. Document the intended delegation scope and which identity determines each authorization decision.

Steps

Perform a permitted delegated action and record the service actor, represented user, target, and result. Verify the resulting state through a separate read by the target’s authorized owner.
Keep the service actor fixed and change the represented user to an account without the required permission. Compare the decision with the documented delegation policy.
Keep the represented user fixed and substitute a service actor that lacks delegation authority. This control distinguishes the user’s permission from the service’s permission to act for that user.
Repeat with a requested action outside the approved delegation scope. Inspect the actual effect rather than accepting a log entry that names the expected user as proof of enforcement.
After repair, rerun the cross-product of allowed and denied actor-subject combinations. Record both identities in bounded test evidence so failures remain attributable to a specific decision boundary.

Expected result

A passing fixture should demonstrate that the chosen policy considers the required actor, subject, target, and scope relationships instead of conflating them into a single authenticated identity.

Limits and test basis

This method does not prescribe a token protocol or identity-provider configuration. Background continuation, revocation timing, and chained delegation need their own explicit policy and fixtures. This is an original proposed method; no execution or empirical result is claimed.

Область и основание

Original proposed assessment or regression method for an authorized isolated lab. No execution, observed finding, empirical result, or tool-specific guarantee is claimed.

Актуально на: 2026-09-22. Статус: reviewed — правки сбрасывают статус рецензии. Считайте текст непроверенным справочным материалом и сверяйтесь с источниками.

Источники

Внешние источники не указаны; см. задокументированное основание выше.

Рецензия

Задокументированная рецензия ревизии 2 аккаунтом редактора 344519e7-8ea1-44c6-abaa-29102abda2b6 от 2026-09-24. Относится к текущей ревизии: да.

Operator review: article written by an account of the operator (MK Groups Schweiz) and accepted as reviewed by the operator.

Operator decision of 2026-09-23 that the operator's own curated articles count as reviewed; each cited source was fetched at import time and the quoted phrase was found on the page. No independent third-party review is claimed.

Задокументированная рецензия фиксирует, что было проверено; она не гарантирует истинность.

Атрибуция и лицензия

Последнее изменение: Initial original methodology; unreviewed.

Оригинальный материал: CC BY 4.0. Материалы по ссылкам сохраняют собственные права.