# Client portal permission test worksheet

Copy this worksheet for your project. The checks below are starting points, not completed test results. Fill the blank fields with your own evidence and mark untested or unavailable information explicitly.

Project / website: ____________________

Prepared by: ____________________    Review date: ____________________

| Test | Expected outcome | Evidence to record | Platform and plan | Date tested | Observed result | Unresolved issue |
| --- | --- | --- | --- | --- | --- | --- |
| Client A opens its own project | Permitted fields and operations are available. | Role, test record, action and observed result. |  |  |  |  |
| Client A requests Client B’s project using a known test identifier | The unauthorised record is not returned. | Request route and denied response, with no real customer data. |  |  |  |  |
| Client A tries to reassign a project to another organisation | The operation is denied unless explicitly authorised. | Attempted change and unchanged stored relationship. |  |  |  |  |
| A user follows another client’s file link | File access follows the intended permission policy. | Authenticated and signed-out outcomes where relevant. |  |  |  |  |
| A staff assignment or account is removed | Access changes according to the documented policy. | Session state, time of change and subsequent result. |  |  |  |  |
| Search, exports, comments and related-record selectors are used | They do not expose information outside the agreed scope. | Results from every enabled access path. |  |  |  |  |

## Review notes

- Decisions and exclusions:
- Unresolved issues:
- Next review date:

Source guide: https://www.peakwebcraft.com/blog/client-portal-builder-record-permissions

Peak Web Craft · Worksheet prepared 1 November 2026