Testing granular permissions

Where is the place to test if an user is, for example, the owner of a
row in
the database?

This seems to be a unit test work due to the “model security”, but since
there is a session (and a logged in user an its id = row.owner.id)
present,
i don’t know if this should be tested with a functional test.

Please, give me some advice. Thanks,
Rodrigo.