I've consulted at a couple of places with similar security risks to this, where I've suggested that we deploy automated testing (perhaps it might be called monitoring since it targets production services) that their auth checks are working -- e.g. that an unauthenticated client can not access a supposedly secure resource, and that authentication as user A does not allow access to data belonging to user B.
Never had any takers.