Add the missing authorization check
Endpoints an audit listed as missing an ownership check, fixed with a test per endpoint proving the wrong actor is refused.
The ticket
Add the missing authorization check to the endpoints an audit listed, and prove the wrong actor is refused.
Acceptance criteria
- Each listed endpoint checks the actor against the resource
- A test per endpoint asserts a refusal for an actor who should not have access
- A test asserts the legitimate actor is unaffected
- Refusals use the existing error shape, not a new one
What lands as proof
Two tests per endpoint, one proving the refusal and one proving the legitimate caller still gets through.
Why teams defer it
- Getting it wrong locks out real users, which makes it feel riskier than most security work of this size.
- The correct rule differs per endpoint. Nobody can work the list mechanically.
- The audit produced a document. Nothing in a document changes state, and the findings sit there until somebody transcribes them into tickets.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: add the missing authorization check to the endpoints an audit listed, and prove the wrong actor is refused. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means one test per endpoint proving the wrong actor is refused, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.