    public function testPOSTForRestProjectManager()
    {
        $post_resource = json_encode([
            'label' => 'Test Request 9748',
            'shortname'  => 'test9748',
            'description' => 'Test of Request 9748 for REST API Project Creation',
            'is_public' => true,
            'template_id' => 100,
        ]);

        $response = $this->getResponseByName(
            REST_TestDataBuilder::TEST_USER_DELEGATED_REST_PROJECT_MANAGER_NAME,
            $this->request_factory->createRequest(
                'POST',
                'projects'
            )->withBody(
                $this->stream_factory->createStream(
                    $post_resource
                )
            )
        );

        $project = json_decode($response->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR);
        self::assertEquals(201, $response->getStatusCode());
        self::assertArrayHasKey("id", $project);
    }
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.