We've had a number of issues where certain operations checked the wrong privileges and this was not identified by the test suite.

• In authz: protect VPC endpoints #743, I found a bug where we weren't checking a "delete" privilege but the "unauthorized" test succeeded by coincidence because the implementation happened to check the "read" privilege. So the unprivileged user still got a 403/404 (I don't remember which).
• During the lead up to the July demo, we found cases where unprivileged users couldn't see global images or their own ssh keys (Authenticated user need privileges on global images and themselves #1341). We didn't notice because we'd been doing all our happy-path testing (both automated and otherwise) using "test-privileged", which has all privileges.

The "unauthorized.rs" test verifies that totally unauthenticated or unprivileged users are not able to do things. And the happy path tests verify that superusers are able to do everything. We don't have tests for anything in between. I'll record more thoughts on this below.