The framing of the matrix as the oracle really clicked for me. Testing only the admin path and one obvious deny leaves exactly the combinations where a lower role reaches a higher privilege action or one user reaches another user's object, which are the failures that matter most. I also appreciated the point that a correct 403 is not enough on its own, since a denied write can still have a side effect and a response body can still leak protected fields. Treating default deny as something that needs its own explicit test, rather than an assumption, is a discipline I want to adopt.