PermitProof

Modern applications depend on authorization rules to decide who can access, modify, export, or delete resources. A small code or policy change can silently change these decisions while conventional tests remain green. This creates a difficult developer problem: manually validating combinations of roles, resources, actions, ownership, tenant boundaries, and account states is time-consuming and easy to miss. PermitProof is a deterministic authorization regression-testing tool that helps developers verify security-sensitive changes before release. The user loads a baseline authorization implementation and a proposed candidate version. PermitProof evaluates a synthetic scenario matrix covering roles, resources, actions, ownership, tenant relationships, and user states. It then compares the authorization decisions between the two versions and identifies meaningful changes such as unexpected access grants, revoked permissions, privilege escalation, ownership bypass, and tenant-isolation failures. Instead of producing only a generic security score, PermitProof shows the exact scenario where behavior changed. For each important finding, the user can inspect the baseline decision, candidate decision, affected role/resource/action combination, and supporting evidence. PermitProof also provides a minimal-counterexample workflow that reduces a complex failing scenario to the smallest set of conditions required to reproduce the authorization regression. From that counterexample, the system generates a focused regression test that developers can copy into their test suite. The final step is an Authorization Change Certificate containing the verification run, scenario counts, detected changes, critical findings, counterexamples, and generated tests. The certificate uses deterministic verification logic rather than relying on an AI model to decide whether the change is safe. The target users are software developers, security engineers, QA engineers, and reviewers responsible for authorization-sensitive applications. What makes PermitProof different is its evidence-first workflow: Authorization Change → Scenario Matrix → Baseline vs Candidate → Access Delta → Minimal Counterexample → Regression Test → Change Certificate. The project uses a fully synthetic dataset so the demonstration is reproducible without personal, client, or confidential data. It is designed as a static web application that can be demonstrated immediately in the browser and deployed through GitHub Pages.