Authorization tests should cover both allowed and denied scenarios. It is not enough to test that an administrator can perform an operation. Tests should verify that regular users cannot perform administrator-only operations and that users cannot access resources belonging to other users when resource-level authorization is required.

Negative authorization tests are especially important because accidental permission expansion can otherwise go unnoticed.