Testing granular permissions


Where is the place to test if an user is, for example, the owner of a
row in
the database?

This seems to be a unit test work due to the “model security”, but since
there is a session (and a logged in user an its id = row.owner.id)
i don’t know if this should be tested with a functional test.

Please, give me some advice. Thanks,