Authentication bugs are loud. Someone gets in who should not, and it is usually obvious afterwards. Authorisation bugs are quiet: a real, logged-in user sees or changes something that was never meant to be theirs, and every log line looks legitimate because the request genuinely came from them.
That asymmetry is why authorisation deserves the larger share of your testing. On this site, 78 of the 106 security-rule assertions we run in CI are checks that something is refused rather than allowed, because a rule that fails open passes every test that only checks the happy path.
Updated August 2026