Permission escalation via role change: pre-release and first 30 minutes checklists

A role or policy change grants users access to resources they should not see.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 7 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Run the team permission tests with every performance flag both on and off, and assert that a non-member sees zero rows from a private team in both states. integration
PR-02Assert that a query reaching the data layer without a team-level filter raises an error instead of returning rows. integration
PR-03Render the digest email for a member of one team and assert that it lists no activity from private teams the member does not belong to. integration
PR-04In a tenant with at least two Spaces, fetch Space data as a user who belongs to only one and assert that the other is denied. integration
PR-05Enumerate every endpoint route and fail the build if any route lacks an authorization policy attribute. security
PR-06Request every admin settings endpoint, including pages hidden from the sidebar, as a non-admin user and assert a 403 Forbidden response. security
PR-07Run the permission synchronization on a staging copy before production and assert that no guest or external account receives a grant to an internal project. security

First 30 minutes

FM-01Revert the authorization change on every production cluster, or undo the permission synchronization run, before investigating further.
FM-02Record the exposure window from the first deploy or sync time to the revert time for each cluster.
FM-03Query access logs for the window and list each account that read a resource outside its role or membership.
FM-04Reset server and client caches that may hold data fetched without the permission filter, and log out sessions active in the window.
FM-05Delete derived content built from unfiltered data, such as digest emails queued for sending or feed posts.
FM-06Ask affected customers to regenerate API keys or reauthorize OAuth integrations that may have pulled data in the window.
FM-07Notify each affected workspace or tenant of the window, the roles involved and the data types exposed.

Download the checklist

Pre-release checklist (Markdown)1.5 KB · v1.0.0
First 30 minutes checklist (Markdown)1.2 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: Run the team permission tests with every performance flag both on and off, and assert that a non-member sees zero rows from a private team in both states.

Questions

What should be checked before a release to prevent Permission escalation via role change?

7 pre-release items, PR-01 to PR-07. PR-01: Run the team permission tests with every performance flag both on and off, and assert that a non-member sees zero rows from a private team in both states.

Is there a rollback plan for Permission escalation via role change?

The first-30-minutes checklist has 7 items. FM-01: Revert the authorization change on every production cluster, or undo the permission synchronization run, before investigating further.

What should a team do in the first 30 minutes after Permission escalation via role change is detected?

The first-30-minutes checklist has 7 items. FM-01: Revert the authorization change on every production cluster, or undo the permission synchronization run, before investigating further.

Is a Permission escalation via role change checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: integration tests and security tests.

Which pipeline stages does the Permission escalation via role change checklist cover?

The pre-release items map to the pre-deploy stages.

In what formats can the Permission escalation via role change checklist be downloaded?

Both checklists download as Markdown files: /downloads/permission-escalation-via-role-change-pre-release.md and /downloads/permission-escalation-via-role-change-first-30-minutes.md, licensed CC BY 4.0.