Authentication establishes who is calling; authorization decides what that caller may access. A focused review follows both through real endpoints, background jobs, and data ownership checks.
Prepare the task
Define the application and environment you are authorized to review, the roles involved, and the operations in scope. Provide test accounts and a disposable test environment when requests can change data.
Work through it with your agent
Map the boundaries
Find a skill for application security review. Ask the agent to identify trust boundaries, session and token validation, and where resource ownership is enforced.
Exercise role transitions
Compare anonymous, ordinary-user, and administrator access to the same operation. Include expired or revoked credentials and attempts to access another test user’s objects.
Turn evidence into a fix
For a confirmed issue, document the affected route and expected denial. Add a regression test that demonstrates the boundary before changing the implementation.
Find a starting skill
Review an application for authentication and authorization risks
Task searches use OpenAI for semantic matching. Keep secrets and repository contents out of the search text. Review the suggested skill’s source and instructions before using it.
What to ask for
A scoped assessment with reproducible findings, affected identities, expected versus observed access, and remediation tests. Separate verified defects from questions requiring more access.
Review the result
Validate findings in the authorized environment and confirm fixes deny the unwanted operation without blocking legitimate users. An agent-assisted review does not establish that the entire application is secure.
Continue the workflow
Connect Claude Code or Codex, then copy the pinned agent prompt from a public skill page.
Related workflow: Agent skills for API reviews and better tests.