Permission Matrix Generator
Authorisation bugs are almost never in the happy path — they are in the combination nobody thought to check. A viewer deleting an archived invoice, an auditor updating billing. This lays out every role, resource and action combination as a checklist and separates them into what should be allowed and what must be refused, because a test suite that only proves the permitted cases work proves very little.
What this generator does
Builds a matrix where higher roles accumulate rights, then enumerates every role-resource-action triple and splits them into allowed and denied. Nothing here produces credentials or payloads — it produces the coverage list.
How to use this tool
- Choose how many roles and resources to cover.
- Read the matrix: each cell lists the actions that role may take.
- Work through the denial list — those are the tests that matter.
- Copy the whole matrix as a checklist for a test suite.
Understanding the controls
- How many roles
- Between 2 and 7, ordered from anonymous up to owner so rights accumulate the way they usually do.
- How many resources
- Between 2 and 7. Every one gets a full set of actions decided per role.
- Seed
- Reproduces exactly the same matrix, which matters if it is being used as a review artefact.
Common use cases
- Building an authorisation test suite with full combination coverage
- Reviewing a role model for gaps before implementing it
- Showing why the denial cases are the ones that catch bugs
- Documenting an access model as a table
- Reproducing the same matrix from a seed
How this generator works
Each cell's actions are drawn with a probability that rises with the role and falls with how destructive the action is, which produces a realistic shape. The check confirms every triple appears exactly once as either allowed or denied — never both, never neither — so the matrix is genuinely a complete checklist.
Randomness and fairness
Which permissions a generated model grants is random; the completeness of the enumeration is not. Seeded matrices reproduce exactly and are therefore explicitly not cryptographically secure. Unseeded, the browser's cryptographically secure generator is used.
For how randomness is produced across the whole site, see how Generate Random works.
Limitations and good to know
- This generates an example model to test against, not your model — the value is the combination coverage, not the permissions themselves.
- Four actions only: read, create, update and delete. Custom actions are not modelled.
- No hierarchy or inheritance between roles beyond the accumulating shape.
- Field-level and row-level permissions are outside what a role-resource grid can express.
- The matrix is not stored between visits, so a permission grid you want to keep needs copying out before you leave the page.
Privacy and your data
The matrix is generated in your browser. Nothing about it or your seed is transmitted or stored.
Related generators
- Access Control Scenario GeneratorPairwise test cases across authentication, role, resource state and origin, with every pair of values proved covered.
- Token Lifetime Scenario GeneratorBoundary test cases for session and token expiry, including the clock-skew window that trips most implementations.
- Input Validation Scenario GeneratorLength-rule test cases sitting exactly on each boundary and either side, plus the whitespace cases people forget.
- Test Matrix GeneratorTurn parameters and their values into a test matrix — full factorial, a random sample, or all-pairs coverage in a fraction of the cases.