My app has different kinds of users (even if it's just free vs paid, or user vs admin) and I want proof that permissions actually hold everywhere. First, map the permission surface: list every endpoint, route, or server action in my app, and note which roles or account states should be able to use it (anonymous, free, paid, admin, owner vs non-owner of a resource). Show me the matrix before writing tests so I can correct any wrong assumptions. Then write tests that walk the matrix: 1. Every protected endpoint rejects anonymous requests. 2. Every role-restricted endpoint rejects users without that role. 3. For resources owned by a user (their posts, their orders, their files), one user cannot read, modify, or delete another user's resources, including by guessing IDs. 4. Paid-only features reject free users at the server level, not just by hiding buttons in the UI. 5. Admin-only actions reject normal users. The important cases are the negative ones. A test proving an admin can access the admin panel is worth a lot less than a test proving a free user can't. If you find an endpoint with no permission check at all, stop and flag it before writing its test. That's a finding, not a test case. When done, run the suite and give me the final matrix with pass/fail per cell.