Real World Example

• Teams at banks and fintechs (Razorpay, PhonePe) keep an access-control matrix and test every cell in CI; security audits ask for this evidence.
• Open-source Spring projects (Spring PetClinic, JHipster-generated apps) ship security slice tests for every controller.

@WebMvcTest({ProductController.class, OrderController.class, SellerController.class, AdminProductController.class})
@Import(SecurityConfig.class)
class AccessMatrixTest {

    @Autowired MockMvc mvc;
    @MockitoBean ProductService productService;
    @MockitoBean OrderService orderService;

    @ParameterizedTest(name = "{0} {1} as {2} -> {3}")
    @CsvSource({
        "GET,    /api/products,               ANONYMOUS, 200",
        "GET,    /api/orders,                 ANONYMOUS, 401",
        "GET,    /api/orders,                 CUSTOMER,  200",
        "POST,   /api/seller/products,        CUSTOMER,  403",
        "POST,   /api/seller/products,        SELLER,    201",
        "DELETE, /api/admin/products/7,       SELLER,    403",
        "DELETE, /api/admin/products/7,       ADMIN,     204"
    })
    void accessMatrix(String method, String url, String role, int expected) throws Exception {
        MockHttpServletRequestBuilder request = request(HttpMethod.valueOf(method), url)
                .contentType(MediaType.APPLICATION_JSON)
                .content("{\"name\":\"Steel Bottle\",\"price\":499,\"stock\":20,\"categoryId\":3}")
                .with(csrf());
        if (!role.equals("ANONYMOUS")) request.with(user("test").roles(role));

        mvc.perform(request).andExpect(status().is(expected));
    }
}

./mvnw -q test -Dtest=AccessMatrixTest

[INFO] Running in.shopease.security.AccessMatrixTest
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 2.117 s - in in.shopease.security.AccessMatrixTest
[INFO] BUILD SUCCESS