Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.
Compare the secure GraphQL response
Run User A against resource-b using the secure field. The HTTP status is 200, but the errors array and null resource show access was denied.
Compare the vulnerable response
Run the insecure field and inspect returned owner, tenant, and note. Mark those stable sensitive fields as evidence.
Normalize noise
Exclude Date, request IDs, durations, timestamps, and session IDs from body similarity. Do not exclude authorization-bearing fields or owner identifiers.
Classify partial leakage
If only an identifier or private field leaks, record exactly which fields overlap instead of treating the whole body as equal or different.
Prove it before moving on.
You can explain a GraphQL 200 denial and a GraphQL 200 exposure using semantic fields, not status alone.