RoleCall: Catch Permission Holes Before Merge

Problem. Broken access control is #1 in the OWASP Top 10:2025, and OWASP found some form of it in 100% of the applications it tested. It usually enters through ordinary pull requests: middleware reordered during a refactor, a guard forgotten on a new route, an ownership check dropped when a helper is extracted. These changes look harmless in review. Test suites stay green because they log in as the admin or as the resource owner and rarely test what other roles must *not* do. SAST tools match patterns but cannot know which role should reach an endpoint. LLM reviewers can only offer an opinion. The hole is found months later by a pentester, or by an attacker. Solution. RoleCall makes authorization review a fast, evidence-based step of every pull request, run inside IBM Bob. 1. Map. In RoleCall's custom Bob mode, Bob drafts rolecall.policy.yaml (who should reach what) using parallel subagents, one per route file. A human approves the draft. 2. Probe. RoleCall starts the app from main and from the PR in throwaway git worktrees. It calls every endpoint as every principal: anonymous, each role, and a second user of the same role for object-level (BOLA/IDOR) checks. 3. Diff. It compares the two permission matrices and the approved policy. It reports ESCALATION, BOLA, LOCKOUT and policy violations, each backed by the real request and response, in a colour-coded HTML matrix and a PR-comment summary. 4. Explain and fix. Bob's authz-critic skill traces each finding to the exact diff hunk. The authz-actor skill writes the minimal fix plus a regression test. RoleCall re-probes to prove the fix. The principle is simple: the probe decides, Bob explains and fixes. No LLM ever decides whether access is allowed. Results. We tested RoleCall on a demo Express API (13 endpoints, 5 principals) with three realistic pull requests: - PR-1, "add audit logging": moved the admin guard below the user routes. The existing tests passed 7/7. RoleCall found 8 escalations, including an anonymous request that deleted a user (401 → 204). - PR-2, "extract lookup helper": dropped an ownership check. RoleCall found 2 BOLA findings: other users could read a private invoice. - PR-3, a pure refactor: 0 findings, so no noise. Overall, RoleCall caught 10/10 holes and the existing test suite caught 0/10. A full audit (130 real HTTP requests and two app boots) takes about 0.55 seconds. Bob's fixes were 3 lines and 1 line, each with regression tests, and each re-audit came back clean. Who it's for. Backend teams and security champions who approve PRs that touch authentication and authorization. RoleCall works with any HTTP app, and its CLI exits non-zero on critical findings so it can gate CI.