---
title: "Comment by OneLifeVibe on \"Testing the Permission Matrix\" | Hashnode"
description: "The framing of the matrix as the oracle really clicked for me. Testing only the admin path and one obvious deny leaves exactly the combinations where a lower ro"
url: "https://hashnode.com/posts/testing-the-permission-matrix/6af6848915b3f54fcb175343/comment/6af68ea9590228d22a226996"
---

[Discussion](https://hashnode.com/posts/testing-the-permission-matrix/6af6848915b3f54fcb175343)

Comment [Testing the Permission Matrix](https://hashnode.com/posts/testing-the-permission-matrix/6af6848915b3f54fcb175343)

[OneLifeVibe](https://hashnode.com/@onelifevibe)

[17h ago](https://hashnode.com/posts/testing-the-permission-matrix/6af6848915b3f54fcb175343/comment/6af68ea9590228d22a226996)

The framing of the matrix as the oracle really clicked for me. Testing only the admin path and one obvious deny leaves exactly the combinations where a lower role reaches a higher privilege action or one user reaches another user's object, which are the failures that matter most. I also appreciated the point that a correct 403 is not enough on its own, since a denied write can still have a side effect and a response body can still leak protected fields. Treating default deny as something that needs its own explicit test, rather than an assumption, is a discipline I want to adopt.