The boundary worth testing
Authentication can succeed while authorisation fails. Merchant, customer, partner and administrator roles need explicit tenant binding across normal requests, exports and asynchronous jobs.
A merchant API may correctly authenticate a caller but fail to bind an object to that merchant. A webhook can be authentic yet replayed at the wrong transaction state. Tests need the product’s expected business decisions, not just a list of endpoint URLs.
What the scope can include
- Object-, property- and function-level authorisation
- Merchant and customer tenant isolation
- Token audience, scopes, expiry and session lifecycle
- Exports, webhooks and asynchronous job access
The final proposal identifies the specific applications, accounts, environments and interfaces included. It also states which prerequisites your team or a supplier must provide.
What useful proof looks like
Use at least two dedicated tenants and a documented role matrix. Compare requests against the same object under different principals and verify ownership in the server-side result.
Preserve UTC time, asset identifier, requesting principal, expected decision and observed response. State-changing tests need confirmation from the resulting object or a trusted audit record. Denied operations and effective controls remain part of the outcome.
Safety and assessment limits
A test of your integration does not authorise testing a payment processor or other tenant. Partner sandboxes and agreed endpoints must be identified in scope.
Use dedicated tenants, synthetic customer data and test payment rails with real settlement disabled. Agree partner-system permissions, transaction limits, rollback and release windows. Production activity must have explicit owners and a clear stop channel.
Close the loop
Connect each weakness to a named owner, immediate safeguard and durable correction. Define positive and negative retest cases so the change restores the intended boundary while preserving legitimate use. Open items retain their dependencies and deadlines.
Preview the sector sample report to see the evidence and treatment-plan format.
