Gambit Stream
Gambit Stream builds iGaming platforms and integrations for operators. Engineering presentations on sportsbook iFrames, operator wallets, player sessions, casino providers and platform migration.
Player Account Management:
A Session Revocation
Test Matrix
Dmytro Nasyrov PhD
The revocation matrix
Field
Review question
Account reference
Which permitted test account does this row cover?
Session path
Which surface and server route evaluate the request?
Control revision
Which account-control revision must govern the action?
Revocation point
When does that revision become effective for this path?
Expected refusal evidence
Which server decision and request trace demonstrate refusal?
Review owner
Who reviews the path and closes its evidence gap?
Fictional account A31
A31 has a web session P31 and an embedded application session P32. The example changes account-control revision C30 to C31 at a declared point T31.
For this exercise, C31 removes permission for a chosen protected action. The acceptance criterion requires both paths to evaluate the effective control before that action.
The matrix records expected evidence. No live account, session token or production system has been used.
Completed row for path P32
Field
Fictional entry
Account reference
A31, a designated synthetic account
Session path
P32 / embedded application / protected server route
Control revision
C31, which removes the selected permission
Revocation point
T31, the declared effective point for this exercise
Expected refusal evidence
Correlated P32 server decision after T31 under C31
Review owner
Account-control owner and embedded adapter reviewer
Coverage across the two surfaces
Path
Evidence status in the example
P31 / web surface
The fixture plan includes its server decision capture. Execution pending.
P32 / embedded surface
The plan has no correlated server decision capture. Unverified.
Shared A31 control
Both rows reference C31 and the declared effective point T31.
Open work
Assign P32 evidence capture before reviewing both paths together.
A visible logout screen alone does not demonstrate server refusal.
The request around the effective point
Specify a request just before T31 and one after T31 for each path. Record which control revision the server evaluates at the decision point.
Agree how a request already in progress is handled. A timestamp in a browser trace cannot by itself settle the server's decision order.
Keep the acceptance result pending when the evaluated revision or decision reference is missing. The reviewer needs a trace that identifies the selected action.
Refusal, expiry and recovery
Case to specify
Evidence to request
Selected permission revoked
Server decision for the protected action under C31.
Old session still presented
The route's rejection or other explicitly permitted behavior.
Session renewal attempted
Proof that renewal follows the current account control.
Control later changes again
A separate row for the new revision and effective point.
Keep legal controls and market-specific timing rules in their own specification.
Server-side session control
OWASP's Session Management Cheat Sheet calls for server-side invalidation when a session expires or the user logs out. It also places timeout enforcement on the server.
The A31 matrix applies that evidence question to two selected application paths. It leaves implementation mechanics and propagation behavior to the actual system contract.
Account platform scope
Gambit Stream's player account management platform scope includes player accounts, wallet state and operator controls.
A PAM-only engagement retains existing game integrations. Identify the surfaces that consume account state and attach a revocation matrix for the protected actions in scope.
Bring the account-control model and the route inventory. Agree permitted test access, expected refusal behavior and the person who accepts each path.
About the author
Written by Dmytro Nasyrov PhD, software architect with 24 years of production experience. Dmytro is the founder of Gambit Stream. He works on production software architecture for iGaming platforms and integrations.
Dmytro Nasyrov. Photo supplied by the author.
Player Account Management: A Session Revocation Test Matrix
By Gambit Stream
Player Account Management: A Session Revocation Test Matrix
Account A31 uses two application surfaces. Control revision C31 leaves one revocation path unverified in a six-field test matrix.
