主题： authorization

• Choosing permission checkpoints for queued jobs after access is revoked

  Make the timing of authorization explicit when a request schedules work that runs later. The proposed exercise separates permission to enqueue work from permission to execute it and retrieve its output.

  methodology · en · reviewed · 知识截至 2026-09-22

• Testing that an emergency bypass ends when its authorization ends

  Check the lifecycle of an explicitly approved emergency bypass in a controlled environment. The proposed method distinguishes ordinary authorization, temporary exceptional authority, and the return to ordinary policy.

  methodology · en · reviewed · 知识截至 2026-09-22

• Keeping authorization enforced when dependencies fail

  Test the security decision made when a required dependency is unavailable. This original fault-injection proposal makes fail-open behavior visible without assuming that every service should return the same error or availability response.

  methodology · en · reviewed · 知识截至 2026-09-22

• Testing that profile updates cannot assign privileged account fields

  Create a narrow regression for updates that accept ordinary profile data alongside fields the caller must not control. The method proposes explicit field ownership rather than a generic input-validation checklist.

  methodology · en · reviewed · 知识截至 2026-09-22

• 调用其他 API 的 MCP 服务器中的令牌透传与混淆代理问题

  MCP 服务器若将客户端令牌转发给下游 API，或使用自身的广泛凭证为任何请求者服务，就会让调用方获得从未被授予的权限。MCP 安全指南禁止令牌透传，并描述了代理服务器中的混淆代理流程。

  article · zh · reviewed · 知识截至 2026-09-23

• Testing continuation cursors after the requesting identity changes

  Check the application’s visibility policy when a continuation cursor is reused under a different principal. This original method treats the cursor as part of a query context whose security meaning must be specified.

  methodology · en · reviewed · 知识截至 2026-09-22

• Testing authorization for workflow transitions instead of screen access

  Check whether a caller may perform a particular state transition, including transitions not exposed by the current interface. This proposed methodology targets approval workflows whose security policy depends on both identity and current state.

  methodology · en · reviewed · 知识截至 2026-09-22

• Checking who may restore a deleted object and its former permissions

  Treat restoring a deleted object as a new authorization decision with explicit permission semantics. This proposed fixture targets the gap between deletion policy and restoration behavior.

  methodology · en · reviewed · 知识截至 2026-09-22

• Testing configuration changes that alter another user’s authority

  Identify configuration writes that indirectly grant permissions even when their endpoint looks like ordinary settings editing. This proposal follows the resulting authority change rather than judging risk from the route name.

  methodology · en · reviewed · 知识截至 2026-09-22

• Testing private export access from request to eventual deletion

  Follow a private export through generation, retrieval, expiry, and cleanup. The proposed method checks the entire artifact lifecycle rather than treating a successful authorization check at export creation as sufficient.

  methodology · en · reviewed · 知识截至 2026-09-22

• Distinguishing denied access from a broken negative-test fixture

  Prevent an agent from treating any error as proof that an access-control test passed. The proposed method uses matched controls to identify whether the application actually reached the intended authorization decision.

  methodology · en · reviewed · 知识截至 2026-09-22

• Testing authorization through resource relationships rather than role names

  Check whether a caller can act on a particular object through the relationship the product actually promises. This proposed lab method treats role labels as fixture attributes, not as the test oracle.

  methodology · en · reviewed · 知识截至 2026-09-22

• Separating the acting service from the represented user in delegation tests

  Test a delegated action with both the executing service identity and the user it represents visible in the oracle. This proposed method avoids treating successful service authentication as sufficient proof of user authority.

  methodology · en · reviewed · 知识截至 2026-09-22

• Checking that nested resource routes bind children to the stated parent

  Validate a relationship that coding agents can omit when building nested endpoints: the requested child must belong to the requested parent under the application contract. This is an original fixture design.

  methodology · en · reviewed · 知识截至 2026-09-22

• Defining the authorization oracle for mixed-object batch requests

  Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.

  methodology · en · reviewed · 知识截至 2026-09-22

• MCP 2026-07-28 授权：签发方检查与客户端注册的变化

  此修订版加强了对授权响应签发方的验证，将已存储的注册凭据绑定到其签发方，并弃用了动态客户端注册。上一修订版就已推荐使用客户端 ID 元数据文档。

  article · zh · reviewed · 知识截至 2026-10-25

• Verifying invitation acceptance against the intended recipient and workspace

  Test the binding between an invitation, its intended recipient, and its destination workspace. The proposed regression is aimed at agent-written onboarding flows that otherwise test only successful acceptance.

  methodology · en · reviewed · 知识截至 2026-09-22

机器可读： JSON