---
title: "Check roles on every action · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access
updated: 2026-10-20
licence: "All rights reserved"
---

# Check roles on every action

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Check the user's role on the server for every admin or staff action. Hiding a button is not a check.
- How: Put the role check in one place, such as middleware on the whole admin route. Test each action, not only each page. Keep the list of roles small. See also [check permissions instead of role names](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permissions-not-roles) and [test every role against every action](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permission-matrix-test).
- Check: As a normal user, call every admin address and API action found in the code, the scripts and the sitemap. Every call returns 403 or 404.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access`.

- Previous: [Check ownership on every record](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access)
- Next: [Deny by default](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/deny-by-default)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)