Test data permissions with two accounts

The decision

A working login page does not guarantee that records are isolated between customers. Every operation that reads or changes a resource must check ownership or membership using trusted server identity. A resource ID from the browser is a lookup input, not permission to access it.

A worked example

Account A creates a draft and Account B copies its result URL. The server should return a controlled denial without revealing the note, title, or whether sensitive content exists. Repeat the test for download, history, editing, deleting, and background-job status; permissions often fail on secondary routes.

How to put it into practice

1. Resolve the actor from the session rather than a userId supplied in JSON.
2. Include ownership in database queries or validate it before returning any data.
3. Check indirect resources, such as a job that refers to a document belonging to another account.
4. Keep administrative paths separate and record access decisions without storing the content itself.

A failure to plan for

Try it on your project

Create two test accounts and a permission matrix. Attempt each operation with the owner, the other account, and an unauthenticated request. Include guessed IDs and copied signed links.