What problem does it solve? Applications often confuse authentication with authorization, letting any logged-in user access or modify resources belonging to others. This Skill systematically audits whether the server enforces authorization for every resource access, catching IDOR, horizontal and vertical privilege escalation, and role-confusion bugs before they ship. ## Core Features & Use Cases - Authorization Matrix Analysis: Maps subject × action × resource cells and verifies each decision is enforced server-side, not just in the UI. - Attack Pattern Coverage: Tests IDOR, horizontal/vertical privilege escalation, participant-vs-owner confusion, role-from-client trust, and moderator scope bleed. - Evidence-Based Reporting: Classifies findings as CONFIRMED, HIGH CONFIDENCE, POSSIBLE, or SPECULATIVE with reproduction steps using two identities. - Use Case: Before launching a multi-tenant feature, audit endpoints like GET /order/{id} to confirm user A cannot read user B's orders and that ordinary users cannot invoke admin actions. ## Quick Start Audit this API's endpoints to verify that authorization is enforced server-side for every resource access, not just authentication.
