Authorization is a correctness property that must be tested, not assumed. For every admin endpoint in your API, write a test that:

1. Authenticates as a regular user (non-admin token)

2. Calls the admin endpoint

3. Asserts the response is 403 Forbidden

4. Fails the test (and the CI build) if it returns anything else

This class of tests is sometimes called “negative authorization tests” or “privilege escalation tests.” They verify that non-privileged roles cannot access privileged functions — which is exactly what BFLA exploits when missing.

For complete coverage, test each role against each function:

• Guest calling user functions → expect 401 (not authenticated)

• User calling premium functions → expect 403

• User calling admin functions → expect 403

• Premium user calling admin functions → expect 403

• Admin calling any function → expect 200 (positive test)

These tests catch regressions: if a developer accidentally removes a role check during a refactor, the test suite catches it before it reaches production.

Generate these tests from the permissions matrix (MIT 05). If the matrix defines what’s permitted, a test generator can automatically produce negative tests for every DENY cell. When a new endpoint is added to the matrix, the negative tests for it are generated automatically.