Field manual / application security

A request is not
a permission.

Trace a worker’s identity, intended audience, requested action and destination. Find the exact check that changes the decision.

A signed request can still ask for the wrong thing. Follow the checks, not just the credential.

01 / Field notes

Two boundaries worth testing.

Separate token verification, the receiving service and permission for a concrete action.

Evaluate an outbound origin, then test a redirect the first decision never covered.