Tenancy
- Sign in as a member of organization A and request a record identifier belonging to organization B.
- Repeat for a write, not only a read.
- Repeat for a file download and for anything that streams live updates.
- Confirm the refusal is a refusal, not an empty page that still performed the write.
Role boundaries
- As a viewer, open a restricted route by typing its address.
- As a viewer, attempt an export and check which fields appear.
- As a working member, attempt an action reserved for administrators.
- Confirm that a hidden menu item corresponds to an actual refusal, not just a missing link.
Attribution and reversibility
- Perform a destructive action and confirm the history names the actor and the time.
- Perform an automated or assistant-initiated action and confirm it is attributed to that actor, not to a person who was not involved.
- Delete a record and search for it in every surface: lists, reports, exports, global search.
- Restore it and confirm its history and identifier survived.
Questions worth asking a vendor
- What enforces this — the interface, the API, or the database?
- Where does the organization on a write come from?
- What happens to an action if audit logging fails?
- Which operations are irreversible, and who can perform them?
- How is access reviewed, and how quickly is it removed when someone leaves?