Manual testing: This requires a course with at least 2 student users. Create a lesson activity with 1 content page and a linked media file Override the permissions on the lesson activity so the lesson:view permission is prohibited for student2 Have student1 view the lesson page Have student1 view the media file (make note of the URL as you will need this later) Verify the lesson activity does not appear to student 2 Have student2 try to directly access the media file (by using the URL you noted earlier). Verify that they do not have access. Automated testing: Run behat for mod_lesson Run phpunit for mod_lesson