✅ OasisPro · Permission Testing · PermissionWorks
Looked right on paper. Broke three other people's access.
IFS Cloud permission testing that stops at reviewing a design document isn't testing. It's proofreading. A permission change can look completely correct on paper and still break access for people who were never part of the original change, simply because nobody tested what actually happens once it's deployed.
Permission changes are rarely isolated. A Permission Set shared across multiple Roles, a Role assigned to people outside the group the change was intended for, an SoD conflict introduced without anyone checking for it. Testing catches these. A design review alone doesn't.
Here are the 6 checks worth running before any access control change goes live.
A permission change reviewed only on paper has been checked for whether it looks right. Whether it actually behaves right, for everyone it touches, is a different question, and only testing in a real environment answers it.
The gap between "the design document is correct" and "the deployed change works as intended" is exactly where permission testing earns its place as a separate, non-optional step.
The 6 IFS Cloud permission testing checks before you push live
- 1. Test in a non-production environment first. A permission change deployed directly to production, with no prior test, has no safety net if something behaves differently than expected. Non-production testing is the step that catches this before it's a live incident.
- 2. Test with a representative user, not an admin account. Admin accounts often bypass the exact restrictions a normal user hits. Testing only with an admin account can make a broken change look fine simply because the test account was never actually subject to the restriction.
- 3. Test what the change removes, not just what it grants. A permission change intended to add access can unintentionally remove something else entirely, especially when Permission Sets overlap. Test both directions, not just the intended one.
- 4. Check the change against your segregation of duties matrix. A change that looks fine in isolation can introduce a real SoD conflict the moment it's combined with someone's existing access. This has to be checked specifically, not assumed away because the change looks small.
- 5. Test edge cases. Someone holding two Roles at once, a Role change mid-approval, a user in more than one company. These edge cases are exactly where permission changes behave unexpectedly, and they're worth testing deliberately, not discovering by accident.
- 6. Get sign-off from the Role's owner before deploying, not after. A named owner reviewing the change before it goes live catches problems while they're still cheap to fix. Reviewing after deployment just documents a problem that's already live.
Why non-production testing is non-negotiable
Deploying directly to production with no prior test means the first real-world check happens in front of live users, at exactly the moment a mistake is most expensive to discover.
Why admin accounts give a false pass
An admin account often has access that bypasses the exact restriction being tested, which means a broken change can look completely fine to the person testing it.
Why the SoD matrix check can't be skipped
A change that looks small and self-contained can still combine with someone's existing access to create a genuine conflict, and that combination is invisible unless it's specifically checked.
The check most permission changes skip entirely
Testing what a change removes, not just what it grants. Permission Sets overlap more than most people expect, and a change intended to add access can unintentionally strip something else from someone who was never part of the original request.
How to build permission testing into your process
Make non-production testing a required step, not an optional one, for any permission change beyond the most trivial.
Build an SoD matrix check into the testing process itself, rather than relying on a separate periodic review to catch conflicts a change introduced.
Require Role owner sign-off before deployment, with the owner actually seeing what the change grants and removes, not just approving a written description of it.
A permission change reviewed only on paper has passed the easiest possible test. Deployment is where it actually gets checked.
What skipping proper testing actually costs
A permission change that breaks access for people outside the group it was intended for, discovered only when they report they can't do their job.
A segregation of duties conflict introduced by a change nobody checked against the conflict matrix, sitting undetected until the next access review.
A rollback under pressure, in production, instead of a fix that would have taken minutes in a non-production test environment.
We'll test your permission changes before they go live.
PermissionWorks tests changes against a representative user, checks both what's granted and what's removed, and runs the SoD matrix check automatically before deployment.
See our segregation of duties guideTest the change before it breaks someone else's access.
Send us your planned permission change and we'll test it against a representative user, check what it removes as well as grants, and run it against your SoD matrix before you deploy.
Why isn't a design document review enough before deploying a permission change?
Because reviewing a document checks whether a change looks correct, not whether it actually behaves correctly once deployed. Permission Sets often overlap in ways that only become visible when a change is tested in a real environment with a representative user.
Why does testing with an admin account give a false result?
Admin accounts frequently bypass the exact restrictions a normal user would hit, so a broken change can pass testing simply because the test account was never actually subject to the restriction being changed.
Should a permission change be tested for what it removes, not just what it grants?
Yes. Because Permission Sets often overlap, a change intended to add access can unintentionally strip access from someone else entirely, and that only surfaces if both directions are tested.
Who should sign off on a permission change before it goes live?
The Role's named owner, reviewing what the change actually grants and removes, not just a written description of it, before deployment rather than after.
Test the deployment, not just the design
A permission change that looks correct on paper hasn't been tested. It's been reviewed. Those are two different bars, and only one of them catches what actually breaks in production.
Six checks, all of them aimed at the gap between looking right and behaving right for everyone the change touches.