Authorization testing for multi-tenant SaaS platforms

Multi-tenant SaaS security lives or dies on authorization. Authentication proves who a user is. Authorization proves what that user can do, which tenant they belong to, which objects they can access, and which actions require elevated privileges.

Start by modeling tenants and roles. Common entities include organization, workspace, project, team, user, group, account, customer, billing profile, report, integration, and admin console. Each entity has expected access rules that should be tested directly.

Object-level testing should vary IDs across tenants, roles, object states, deleted records, archived records, invited users, suspended users, and recently transferred ownership. Many bugs appear only when state changes.

Function-level testing checks whether users can perform actions they should not: invite admins, change billing, rotate API keys, export data, approve workflows, update SSO settings, or access support impersonation features.

Frontend checks are not enough. The UI may hide a button while the API still accepts the action. Testing should use direct API requests, mobile traffic, GraphQL operations, and replayed browser requests.

Evidence should explain expected authorization, actual outcome, affected object, user role, tenant context, and impact. Without this, authorization findings often get stuck in debate.

DeepScan is built for this kind of variation testing. Agents can explore role and object combinations, capture request evidence, and hand validated findings to operators for severity and report review.