Authorization flaws are the highest-impact, least-automated vulnerability class in SaaS. This field manual catalogs the failure patterns Sybil finds most often in multi-tenant systems — IDOR chains, role-boundary gaps, state-machine abuse — with anonymized case studies and remediation patterns for each. A reference for AppSec teams shipping multi-tenant products under real deadline pressure.