# Team, membership, role, owner, assignment

**Test family:** `RBAC`

- **RBAC-001** Test anonymous, unauthenticated, invited, member, owner, admin, suspended, removed, and another-tenant identities.
- **RBAC-002** Deny access through UI, direct URL, API, ID substitution, search, export, notification, cache, and websocket.
- **RBAC-003** Grant/revoke takes effect across open sessions and derived caches without requiring a new login unless promised.
- **RBAC-004** A user cannot grant permissions they do not possess or assign a more privileged role.
- **RBAC-005** Team inheritance, nested teams, direct grants, denies, and role precedence produce an explainable effective permission.
- **RBAC-006** Empty team, last owner/admin removal, self-removal, owner transfer, and orphaned object have safe rules.
- **RBAC-007** Assign only eligible actors; removed/disabled actors cannot be newly assigned.
- **RBAC-008** Concurrent assignment and stale UI do not silently overwrite; notification goes to final intended assignee once.
- **RBAC-009** Bulk actions apply authorization per object, not only at the collection level.
- **RBAC-010** Error differences do not reveal existence of unauthorized objects.
- **RBAC-011** Audit records actor, grant source, before/after scope, timestamp, and impersonation/delegation context.

## Comprehensive per-item coverage

- **RBAC-012** Exercise new, active, unverified, invited, suspended, locked, disabled, deleted, merged, and partially provisioned identities.
- **RBAC-013** Use identifiers containing ASCII emoticons, emoji/ZWJ sequences, kaomoji, accents, mixed scripts, RTL, confusables, invisible characters, and boundary lengths.
- **RBAC-014** Compare absent, unknown, malformed, valid, expired, revoked, replayed, and wrong-tenant credentials or identifiers without account enumeration.
- **RBAC-015** Use UI, API, SSO, SCIM, invitation, import, admin, recovery, and migration paths; converge on one identity and policy model.
- **RBAC-016** Test exact duplicates, case variants, normalization equivalents, alias collisions, recycled identifiers, and concurrent creation atomically.
- **RBAC-017** Change username, email, phone, external subject, team, role, owner, and tenant; preserve links, history, authorization, and audit.
- **RBAC-018** Change role or account state between rendering, authentication, challenge, and commit; reauthorize the final operation.
- **RBAC-019** Attempt cross-user and cross-tenant lookup, suggestion, recovery, invite, export, cache, and error paths; reveal no hidden existence or data.
- **RBAC-020** Brute-force, credential-stuff, enumerate, resend, and lock accounts within a safe test envelope; balance abuse resistance and denial-of-service risk.
- **RBAC-021** Race login, logout, password reset, MFA reset, email change, suspension, deletion, and session refresh; define which security state wins.
- **RBAC-022** Retry after timeout and replay old links, codes, tokens, signed requests, and callbacks; enforce expiry, audience, nonce, and one-time use.
- **RBAC-023** Verify current and remembered sessions, trusted devices, refresh tokens, API tokens, and linked providers after each security-sensitive change.
- **RBAC-024** Force identity provider outage, delayed email/SMS, expired admin session, partial provisioning, and rollback failure; provide a recoverable state.
- **RBAC-025** Use keyboard, password managers, autofill, screen readers, zoom/reflow, translated errors, RTL, and mobile keyboards without weakening security.
- **RBAC-026** Inspect URL, referrer, DOM, storage, clipboard, logs, traces, analytics, support tools, notifications, exports, and screenshots for credential or PII leakage.
- **RBAC-027** Notify the right channels of sensitive changes without including secrets or actionable one-time credentials.
- **RBAC-028** Record actor, authority, target, old/new security state, request/trace ID, time, source, and outcome in tamper-resistant audit.
- **RBAC-029** Measure authentication, directory lookup, authorization, provisioning, and revocation latency at normal and supported load.
- **RBAC-030** Delete, anonymize, retain, restore, export, and merge identities according to legal and product policy without orphaning ownership.
- **RBAC-031** Test stale clients, clock skew, region failover, cache lag, and key rotation; fail closed for authorization while preserving recovery.

[Back to Authentication, people, and access index](../../auth-people-access.md)
