When doing functional tests I see many people also check the permissions by using
System.runAs(userWithRightPermission) in most of their tests.
I see good reasons for doing this, because then you actually test that only allowed user can use a certain feature. And with permissions being a declarative feature, developer tend to forget putting classes and pages into perm sets sometimes.
But it still feels wrong to spam every single test with User and Permission creation. My opinion until now was that on a few tests which actually proof that permissions are applied should use
System.runAs() while the others use the default admin. As permissions an access are a declarative feature there actually should not be tests. Or do you write Apex tests to check Validation Rules?
Is there a documented Best Practise or some smart experts opinions on this out there?