licitly for an entire subtree, while for the other nodes rules are inferred. More details
    about this can be found on the Access Control <a href="contextOptions.html">Context options</a> help page.</td>
</p>

<h2>Testing procedure</h2>

<p> As a whole, in order to fully perform access control testing for a web application, the next steps should be
    followed:</p>
<ul>
    <li>the tester defines set of Users and how they authenticate;
    </li>
    <li>the tester defines how ZAP can identify un-authoriz