# Every test sent again as the wrong user, so a pass means the check exists.

Permission tests (live). Tests per route and per role, each sent again as a user without permission. It must be refused.

In: your running app and its roles.

The proof: 269 of 304 BookStack tests refused to the wrong user. BookStack v26.05.5 · run of 26 Sep 2026, 17:42 UTC · commit 0f5164ec.

## What it is made of

- **Generated tests, with the wrong-user check**: Tests written from the map that run, each re-sent as the wrong user. Receipt: 304 of 304 pass · 269 refused to the wrong user. When: since 26 Sep.
- **Runs, with evidence**: Every test: what was sent, what came back, why it failed, a picture. Receipt: 256 pictures in the latest run. When: since 26 Sep.

---

The page this twin stands for: https://featkpr.com/services/permission-tests. Every page on this site has a `.md` twin, and answers `Accept: text/markdown`.