Permission Enforcement
Verify that role permissions are properly enforced, preventing unauthorized actions.
Preconditions
- You have a team member with limited permissions (e.g., view-only for products)
- You can log in as that team member
Test Data
Team member with "Products: View only" permission (no create, edit, delete)Test Steps
Follow each step carefully
Log in as the team member with limited permissions
Use team member credentials
Logged in as limited permission user
Navigate to Products section
Admin > Products
Products page loads showing product list
Attempt to create a new product
Look for "Add Product" or "Create" button
Button is hidden/disabled OR clicking shows permission error
Click on an existing product to view details
Click on a product row
Product detail page loads (view is allowed)
Attempt to edit the product
Look for Edit button or try to modify fields
Edit button hidden/disabled OR changes cannot be saved
Attempt to delete the product
Look for Delete button
Delete button is hidden/disabled OR deletion is blocked
Navigate to a section with no access (e.g., Settings)
Try to access Settings if not permitted
Settings link is hidden OR shows access denied message
Expected Result
Permission enforcement works: (1) UI hides unauthorized actions, (2) Attempting blocked actions shows clear error, (3) API calls are also blocked (not just UI), (4) Can perform allowed actions normally, (5) No way to bypass permissions through UI manipulation.
Ready to Complete?
Click when you have verified all steps and the expected result.
Test Info
- Module
- Team & Roles
- Steps
- 7
- Duration
- 6 min
- XP Value
- +30