---
name: pentest-authentication-authorization-review
description: "Security assessment skill for authentication and authorization controls. Use when prompts include session handling, token abuse, MFA weaknesses, account takeover, IDOR/BOLA/BFLA, privilege escalation, tenant isolation, or identity boundary validation. Do not use when the task is generic recon, pure parser fuzzing, or final report composition only."
---

# Authentication & Authorization Review

## Activation Triggers (Positive)
- `auth`
- `session`
- `token`
- `mfa`
- `idor`
- `bola`
- `bfla`
- `privilege escalation`
- `tenant isolation`

## Exclusion Triggers (Negative)
- `recon only`
- `injection fuzzing only`
- `write report only`

## Output Schema
- Access-control matrix: `actor`, `resource`, `action`, `expected`, `observed`
- Session/token lifecycle findings: `issued`, `replayed`, `revoked`, `result`
- Confirmed boundary breaks with attacker capability statement

## Instructions
1. Define identity roles and expected permissions before testing.
2. Validate both horizontal and vertical boundaries with paired-role comparisons.
3. Test session and token invalidation across interfaces and time windows.
4. Confirm authorization at object, function, and workflow levels.
5. Distinguish authentication weakness from authorization weakness in output.
6. Escalate only confirmed boundary failures into exploit chaining.

## Should Do
- Use explicit role-to-action test cases.
- Capture full evidence for accepted and denied control paths.
- Verify revocation behavior, not just issuance behavior.

## Should Not Do
- Do not infer access-control findings from UI behavior alone.
- Do not conflate missing data with denied access.
- Do not mark privilege escalation without deterministic proof of crossed boundary.