How to test user roles and permissions (RBAC) side by side
Short answerCreate one QA SessionLab session per role, log in once in each, then open the Role matrix: it opens the same URL as every role in tiled windows and lets you navigate, reload or go back in all of them together, so permission differences are visible immediately.
Step by step
- Create the rolesIn the side panel use “+ RBAC set” (Admin, Staff, Customer, Guest) or add your own role names.
- Log in once per roleOpen your app in each session tab and log in with that role’s test account. Use Snapshots to save the logged-in state.
- Open the Role matrixPick the roles, enter the URL to check and choose “Open side by side”. Each role opens in its own tiled window.
- Drive all roles togetherNavigate, reload or go back in every role at once and compare buttons, menus, data and error pages.
- Record what is wrongPress Alt+Shift+R in the tab that misbehaves; QA SessionLab writes a Markdown bug report with steps, console errors and failed requests.
Why this works
- Permission bugs hide in differences between roles: a button that should not be there, data from another tenant, a 403 that should be a 200.
- Logging out and in again between roles is slow and makes it easy to miss differences.
- Seeing all roles at the same moment turns RBAC testing into a visual comparison.
Questions
Can an AI agent run the comparison?
Yes. The qsl_compare_roles MCP tool opens a URL as several sessions and returns what each role sees, so an AI assistant can report permission differences objectively.
How do I reset data after destructive tests?
Save a Snapshot (cookies, localStorage, IndexedDB) before the test and restore it afterwards.