On our authorised website, please use fictional accounts and non-sensitive files to check permissions against [roles and expected viewing and downloading scope]. Check both page links and known file URLs, including signed-out access within the agreed scope, and record allowed, denied and untested cases. Who will correct differences from the expected results, and when will they be rechecked? Do not use real private information or go beyond the authorised scope.
