    it "to xml" do
      expect(user.to_xml).to eql([user.name].to_xml)
    end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.