@Test
  public void testCoveringCheck() throws Exception {
    // Grant read access to USER_OTHER
    grantOnTable(TEST_UTIL, USER_OTHER.getShortName(), testTable.getTableName(), TEST_FAMILY, null,
      Action.READ);
    // Grant read access to GROUP
    grantOnTable(TEST_UTIL, AuthUtil.toGroupEntry(GROUP), testTable.getTableName(), TEST_FAMILY,
      null, Action.READ);

    // A write by USER_OTHER should be denied.
    // This is where we could have a big problem if there is an error in the
    // covering check logic.
    verifyUserDeniedForWrite(USER_OTHER, ZERO);
    // A write by GROUP_USER from group GROUP should be denied.
    verifyUserDeniedForWrite(GROUP_USER, ZERO);

    // Add the cell
    verifyAllowed(new AccessTestAction() {
      @Override
      public Object run() throws Exception {
        try (Connection connection = ConnectionFactory.createConnection(conf);
          Table t = connection.getTable(testTable.getTableName())) {
          Put p;
          p = new Put(TEST_ROW).addColumn(TEST_FAMILY, TEST_Q1, ZERO);
          t.put(p);
        }
        return null;
      }
    }, USER_OWNER);

    // A write by USER_OTHER should still be denied, just to make sure
    verifyUserDeniedForWrite(USER_OTHER, ONE);
    // A write by GROUP_USER from group GROUP should still be denied
    verifyUserDeniedForWrite(GROUP_USER, ONE);

    // A read by USER_OTHER should be allowed, just to make sure
    verifyUserAllowedForRead(USER_OTHER);
    // A read by GROUP_USER from group GROUP should be allowed
    verifyUserAllowedForRead(GROUP_USER);
  }
Insure we are not granting access in the absence of any cells found when scanning for covered
cells.
hbase-server/src/test/java/org/apache/hadoop/hbase/security/access/TestCellACLs.java