OWASP Authorization Cheat Sheets

Official docs outline

Authorization
Least privilege, deny by default, enforcing checks on every request and RBAC/ABAC.
Access Control
Access control models and implementation guidance.
Authorization Testing Automation
Automating authorization tests with access matrices.
Insecure Direct Object Reference Prevention
Object-level authorization and indirect references.
Mass Assignment
Binding request data to models safely using allow-lists and DTOs.
Multi-Tenant Security
Tenant isolation and cross-tenant authorization.
Business Logic Security
Preventing abuse of valid application workflows.
Unvalidated Redirects and Forwards
Open redirect prevention.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.