Security tests should attempt unauthorized access to objects, endpoints, functions, and tenant data.

Test expired tokens, wrong audiences, invalid signatures, missing scopes, role escalation, malformed input, injection attempts, oversized requests, rate-limit behavior, and sensitive-field exposure.

The goal is not merely to prove that valid users can access valid resources. The goal is to prove that invalid users cannot access resources or operations outside their authority.