How APVISO Tests for Broken Access Control

Broken access control is broader than a single endpoint bug. APVISO tests whether users, roles, tenants, and API clients can perform actions outside the intended policy. That requires mapping the application's permission model and probing it from multiple angles.

The recon agent discovers candidate routes and API actions. The scanner agent attempts role switching, forced browsing, tenant manipulation, method changes, and object swaps. The lead agent evaluates whether the observed behavior violates the intended business rule.

Findings are written in terms developers and auditors can understand: expected permission, actual behavior, reproduction steps, affected resource, and recommended enforcement point. Retesting is important because access-control fixes often need regression coverage across many endpoints.