To test access to a certain configmap, for example, run something like this:

$ kubectl --as=system:serviceaccount:MY_NAMESPACE:MY_SERVICE_ACCOUNT auth can-i get configmap/MY_CONFIGMAP

Replace get with other verbs as necessary.