  def user_with_viewer_rights_should_fail_to_edit_a_domain
    setup_users
    get :edit, {:id => @model.id}
    assert @response.status == '403 Forbidden'
  end
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.