Developer Tools / BROWSER-ONLY UTILITY
API Access Matrix Planner
Write down who should be allowed before testing who actually is. This planner expands your policy into explicit expected outcomes.
List the roles, then add a method, path, allowed roles and ownership rule for each route. Use paths such as /documents/{id}, not real private identifiers or full URLs. Limit: 100,000 characters.
Loading local tool code...
Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.
Result
Technical details (optional)
Review the result before sharing. It may still contain personal or confidential information.
Start with the routes you need to test
Give each route its HTTP method and path template. GET and DELETE on /documents/{id} are separate routes with potentially different rules. Use short role names that start with a letter and contain letters, numbers, underscores or hyphens. Do not include query strings, fragments, credentials or real object identifiers in a path.
Choose what ownership means
Own permits a listed, authenticated role to access only its own object. Any permits that role to access its own and other objects. None means ownership is not modelled for the route. Roles not listed as allowed are denied in the plan. The planner cannot infer administrator rights, role inheritance or tenant boundaries from a name.
Include anonymous and missing-object cases
The planner includes an anonymous role even when you have not listed one. For an intentionally public route, add anonymous to its allowed roles. Own-only routes never grant anonymous access. Object-based routes also get missing-object cases with deny-or-not-found expectations. Your application tests must choose the actual status and response contract.
Expected does not mean observed
The output contains planned assertions, including denial without protected data or side effects. It does not log in, fetch a URL or confirm a bypass. Add field-level and tenant-specific checks where needed. Route templates and role names appear in exports, so do not include credentials or private object identifiers.
References
Documentation reviewed: . Rule results describe the supplied text, not a live application test.
Useful next steps
Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.