Authentication & Authorization Review

Use When

• Session replay, token lifecycle, MFA behavior, account takeover, tenant isolation, or identity-boundary validation is the main question.
• The task needs paired-role testing for object, function, or workflow authorization.
• The next step is to distinguish authentication failure from authorization failure.

Handoff Criteria

• Hand off to pentest-advanced-access-control-auditor for a deep IDOR, BOLA, BFLA, RBAC, or ownership test matrix.
• Hand off to pentest-input-protocol-manipulation when parser behavior or request mutation becomes the owner blocker.
• Hand off to pentest-evidence-structuring-report-synthesis when live validation is complete.

Output Schema

• Access-control matrix: actor, resource, action, expected, observed
• Session/token lifecycle findings: issued, replayed, revoked, result
• Confirmed boundary breaks with attacker capability statement