Tested Application Step 4: Pick the Layer

For every behavior on your priority list from module 1, decide which layer tests it and write down why. Push each one as low as it will go. Where a rule can only be reached through the whole stack, ask whether it should be extracted into something testable on its own, and extract it where the answer is yes. Then write the integration tests for your security properties, because that is the highest-value combination in this kind of application.