An administrator must diagnose what a normal user can access. What is a useful controlled testing technique?

1. Assume a visible menu guarantees every field permission
2. Impersonate the user and verify the relevant operations
3. Change the user's password to share it
4. Test only with an unrestricted admin session