Inventory every user role and protected action in this application. Build an authorization matrix showing which roles may view, create, update, delete, approve, administer, or export each protected resource.

Trace enforcement through URLs, routes, views, APIs, services, templates, and database rules. Distinguish presentation controls from server-side enforcement. Identify ambiguous rules, missing denials, privilege-escalation paths, and actions protected only by a hidden button.

For every important permission, propose both an allowed-path test and a direct denied-path test. A denied test must attempt the protected route or API directly and prove that protected data and database state remain unchanged.

Do not change permissions or tests yet. Present the matrix, evidence, uncertainties, and proposed test files, then wait for approval.