Scenario testing evaluates authorization through realistic, end-to-end requests rather than isolated rule checks. Each case supplies a principal, action, resource, request context, and relevant entity data to a policy decision point (PDP), then verifies the expected decision. section 10.3
A useful scenario test can verify:
- Schema validation and relationship traversal along the complete decision path. section 10.3
- Interactions among multiple policies, including global forbids and delegated access. section 10.3
- Positive and negative outcomes for the same resource, making unintended access or denial visible. section 10.3
- Past failures and major rules when combined with regression and coverage tests. section 10.3
Project membership and document viewing
Model Alice as a member of Project Alpha and Fay as a nonmember. Submit the same document-view request for both employees: Alice should receive ALLOW, while Fay should receive DENY. The test uses a small entity store and checks the relationship that the policy depends on. section 10.3
Delegated collaboration
Test whether Jack, a customer, can share the Q3 plan with Bob, his account manager. This scenario checks that delegation works across the relevant policies and relationships. section 10.3
// Test: project members can view Project Alpha documents
given:
principal = Employee::"alice"
action = Action::"doc:view"
resource = Document::"alpha-roadmap"
entities = {
Employee::"alice" in Project::"alpha",
Document::"alpha-roadmap" in Project::"alpha"
}
expect:
ALLOW
// Fay is an employee, but not a member of the project
given:
principal = Employee::"fay"
action = Action::"doc:view"
resource = Document::"alpha-roadmap"
entities = {
Employee::"fay" not in Project::"alpha",
Document::"alpha-roadmap" in Project::"alpha"
}
expect:
DENY
The compact test notation makes the decision inputs, entity relationships, and expected ALLOW or DENY result explicit. section 10.3
Scenario tests are most useful in continuous integration, where quick policy evaluation catches regressions before signed, versioned bundles reach runtime policy stores. Decision logs, explainability, and rollback features add operational visibility when a scenario fails. section 10.3 section 10.5
