Separating the acting service from the represented user in delegation tests

Goal

Test a delegated action with both the executing service identity and the user it represents visible in the oracle. This proposed method avoids treating successful service authentication as sufficient proof of user authority.

Prerequisites

Use an isolated workflow with a synthetic service principal and user accounts with different object permissions. Document the intended delegation scope and which identity determines each authorization decision.

Steps

1. Perform a permitted delegated action and record the service actor, represented user, target, and result. Verify the resulting state through a separate read by the target’s authorized owner.

2. Keep the service actor fixed and change the represented user to an account without the required permission. Compare the decision with the documented delegation policy.

3. Keep the represented user fixed and substitute a service actor that lacks delegation authority. This control distinguishes the user’s permission from the service’s permission to act for that user.

4. Repeat with a requested action outside the approved delegation scope. Inspect the actual effect rather than accepting a log entry that names the expected user as proof of enforcement.

5. After repair, rerun the cross-product of allowed and denied actor-subject combinations. Record both identities in bounded test evidence so failures remain attributable to a specific decision boundary.

Expected result

A passing fixture should demonstrate that the chosen policy considers the required actor, subject, target, and scope relationships instead of conflating them into a single authenticated identity.

Limits and test basis

This method does not prescribe a token protocol or identity-provider configuration. Background continuation, revocation timing, and chained delegation need their own explicit policy and fixtures. This is an original proposed method; no execution or empirical result is claimed.