Informational Fresh jira_story: GOV-153

Lesson 4 of 4 — RBAC defence-in-depth tests

Cross-Cutting & Hardening · Source: Jira Story GOV-153 (3 pts) · Authority: Informational (the Jira story is authoritative).

Purpose

Verify RBAC holds at both UI and API with negative tests.

Why it matters

You only know RBAC works when the 'should-fail' cases actually fail.

Where this lives

Runs in the Customer AI Governance platform (components: platform). Negative RBAC tests assert UI hiding and API 403 for unauthorized roles. Learn teaches this read-only.

Workflow

Given an auditor or owner
When negative tests run
Then they pass green (UI hidden and API 403)

Worked example

RBAC tests are all 'can-do' assertions. What's missing?

The negative 'must-not' cases — auditor/owner deny paths (UI hidden and API 403) must be tested.

Acceptance criteria (authoritative — GOV-153)

Given an auditor or owner, when negative tests run, then they pass green (UI hidden and API 403).

Common pitfalls

Testing only happy paths, missing the deny cases.

Knowledge check

Scenario: RBAC tests are all 'can-do' assertions. What's missing?
Look for: The negative 'must-not' cases — auditor/owner deny paths (UI hidden and API 403) must be tested.

Key concepts

RBAC negative tests
defence-in-depth
deny-path coverage

For the AI Tutor

Summary: Verify RBAC holds at both UI and API with negative tests.
When to use: teaching or answering questions about "rbac defence-in-depth tests".
When NOT to use: resolving the role itself (that is GOV-103).
Key concepts: RBAC negative tests, defence-in-depth, deny-path coverage.

Completion criteria

Learner passes the scenario knowledge check and can point to the system state that satisfies GOV-153's acceptance criterion.

Module: LEARN-MOD-005 (Cross-Cutting & Hardening)
Provenance: LEARN-MAP-001 · Generation standard: LEARN-STD-002
Next: (module complete)