Which actions need separate permission decisions?
List the real jobs performed in the archive: connecting accounts, reviewing content, exporting records, managing users and approving any destructive operation. Assign only the access each role needs under your organization’s policy. Do not assume a role name has the same meaning across products, or infer an untested permission from a successful login.
Work through a realistic example
A communications reviewer needs to find a campaign conversation, while a records administrator manages broader retrieval work. Test both users with harmless sample records. Verify the allowed task and an action that should be denied. A single administrator demonstration cannot establish that the restricted role behaves correctly.
Run the workflow
- Build a role-to-action matrix and have the accountable owner approve it. Include account scope and export access, not just the ability to enter the application.
- Create approved test identities and exercise both allowed and denied actions. Record the observed behavior without sharing real credentials or sensitive records.
- Remove or change test access through the normal process and verify the resulting state. Review how authentication, existing sessions and ownership changes are handled.
Check the evidence
| Check | What to verify | Evidence to keep |
|---|---|---|
| Least privilege | Each role can perform its approved task and not the prohibited one. | Positive and negative test results. |
| Offboarding | Removed access is verified through the agreed procedure. | Time, action and observed result. |
| Accountability | Administrative changes have the expected evidence. | Available audit record and reviewer sign-off. |
Record the decision and its limits
Keep the matrix, test evidence and exceptions with the service’s access-review process. Recheck when responsibilities or authentication arrangements change. Use documented recovery procedures so a security change does not leave the organization without an authorized administrator.
Keep in mind: This is a test plan, not a claim about a particular Brolly role’s permissions. Confirm the current product behavior and agreed configuration in your own evaluation.
Further reading and scope
Reviewed October 14, 2026. These practical exercises are editorial guidance, not a guarantee of platform coverage or a substitute for your approved records policy.
- FTC: Start with Security — General security background; not a product certification.
- CISA: social media account protection — Account-security background; use your organization’s approved access process.
Common questions
Is single sign-on enough to prove access is correct?
No. Authentication and authorization answer different questions. Test what the signed-in identity can view and do after login.
Should we test with real sensitive records?
Prefer harmless synthetic samples. Where a real-data test is necessary, obtain the appropriate authorization and apply the organization’s handling controls.
Put the guide to work
Use the downloadable workbook to record your requirements, test results and questions for shortlisted providers.