You don't need expensive tools to start this; you need a shift in mindset. Here is a framework for getting started.

It is the discipline of verifying that a user with a specific role (e.g., "Admin," "Editor," "Viewer," "Customer") can access exactly what they need—and absolutely nothing else.

If you work in software development, you are likely familiar with the concept of "Personas." You know the drill: “Meet Alice. She is a 45-year-old manager who uses the software to approve budgets.”

It looks like you’re asking to complete the phrase — which appears to be Swedish for "role-specific test" (from roll = role, specifik = specific, test = test).

A malicious user can simply open the developer console, find the ID of the delete button, or call the API endpoint via Postman/Curl. If the backend doesn't check the role token, the data is gone.