Every role, every endpoint, judged against the truth.
Five engines probe the API and compare what the server does with what
role_permissions says should happen. A disagreement is a defect, never a guess, and a route
nobody probed is reported as untested rather than as a pass.
Authorization matrixEvery role against every endpoint, writes included
Security and contractForged tokens, public-route drift, leaked internals
Load and tenant scopeTraffic weighted by the API's own counters, cross-warehouse reads
Internal tooling. Results describe the API's authorization surface, so treat access to them accordingly.