JoyGhoshs/AuthMatrix-Reloaded ? reverse-engineered prompt

Build me a Burp Suite extension in Python that helps test broken access control across multiple users and roles.

I want to be able to define roles, add several users per role, capture real requests from Burp as endpoints, and then replay those requests under different identities to spot BOLA, BFLA, and BOPLA issues. Please include a matrix view that shows each endpoint against each user with clear color coded results, plus a way to inspect the exact request and response behind each result.

It should handle common auth stuff like cookies, bearer tokens, custom headers, CSRF tokens, session refresh, and JWT inspection. If possible, make it smart about masking changing values so it does not give noisy results, and let me mark which endpoints should be allowed for which roles. I also want JSON and HTML export for findings, and it would be great if it can safely skip static assets and support GraphQL requests too.