Functionality and permission are separate
A feature can behave exactly as its demonstration intended while exposing another user’s data. Success-path testing establishes that an operation can happen. Security testing asks who can make it happen and under which conditions.
Start by writing down the trust boundaries: browser to server, user to tenant, application to database and application to external provider. Each boundary needs explicit checks.
Authorisation belongs near the data
Do not rely on hiding a button or on an identifier being difficult to guess. Test direct requests. Confirm that the server checks access to the specific resource for every operation, including exports, background jobs and downloads.
Use tests involving at least two users and, where applicable, two tenants. A single account can confirm a feature works while concealing the absence of isolation.
Follow secrets and personal data
Inventory credentials in source, configuration, logs and third-party calls. Record what personal data leaves the system and why. An AI-generated integration deserves the same review as any other dependency.
Data minimisation reduces the consequences of an error. Do not send full records to an external service when the feature needs a small subset.
Make the checks repeatable
Record the cases that matter and run them when the application changes. A one-off review can identify a problem; repeatable checks help prevent its return. Pair the checks with an owner for dependency updates and incident response.