Can a Viewer open your billing page?
Permissions break on the pages nobody opens as the wrong user. Smoketest signs in as each role you save, checks what it can reach, including what it should not, and leaves the proof on the ticket.
Moved to QA. Viewers can read invoices and change nothing.
Failed · 1 of 4 requirements not met · 3m 05s · Attempt 1
- ✓An Owner can change the plan
- ✓A Member cannot invite people
- ✓A Viewer can read invoices
- ✗A Viewer cannot open Billing settings
Not tested: single sign-on accounts, because the ticket only covers email sign-in.
Watch the recording · View attempt
Good catch. The button is hidden but the route has no check. On it.
It tries the doors that should stay shut.
Can each role get in?
It signs in with a saved test account for each role.
Can they do their work?
It goes through the pages and actions each role needs.
What should stay shut?
It opens the page directly, and checks that it is refused.
What usually slips through
Everyone checks the role they signed in with. These are the parts that break later.
A page opened from a link
The button is hidden, but a saved link still opens the page.
A new role
A role added this sprint can do more than anyone meant it to.
A removed role
Someone loses access and keeps it until they sign out.
Bulk actions
A role cannot edit one row, but can still edit them all at once.
Questions about testing roles and permissions
As many as you have test accounts for. Save one for each role, and it picks the right one for each check.
Save a sign-in for each test account. If your product uses email codes or magic links, give the account its own inbox and it reads them.
Yes. It tries the page or the action as that role and checks that it is refused, including from a direct link.
No. It reads the ticket and the pull request and works out which roles the change touches. A playbook can add the rules you always want checked.
Yes. A page can hide a button while the request behind it still works, so it can make the same check against your API.
It starts at $399 a month for 1,000 runs. Each run is up to 10 minutes, and a longer test counts as two runs or more, one for every 10 minutes. If your team needs more, we design a Scale plan with you, so you stop buying extra runs.
Every result links to the recording, the steps, and the reasoning, and says what it did not test, so you can check its work the way you would check a teammate's.
Give it your next permissions ticket.
Book a call and we will run one ticket with your test accounts. You get the result and the recording the same day.