Worked example
The authorization review
Follow one authorization finding from the failed boundary to the evidence needed for approval.
Example review record · Workspace invitations
The role check passed. The workspace check was missing.
- Change under review
- Record a pending invitation in the requested workspace.
- Review decision
- Hold approval until the workspace boundary is enforced and checked.
- Owner
- Implementing engineer repairs the path; the second engineer reviews the evidence.
The finding
In this review scenario, the handler checks whether the caller has an administrator role but does not tie that role to the requested workspace. The cross-workspace case exposes the gap: an administrator in A can reach invitation creation for B. The ordinary administrator case would miss it.
The affected boundary is authorization before persistence. Moving a client-side check or hiding the workspace selector would leave the server path open. The repair must resolve membership and permission for the target workspace before creating or returning an invitation.
Evidence to collect after repair
| Check | Required evidence |
|---|---|
| Administrator in A invites into A | Allowed result and one invitation owned by A. |
| Non-administrator in A | Denied result and no new record. |
| Administrator in A targets B | Denied result and no record created or returned from B. |
| Duplicate and concurrent requests | The specified single-record behavior still holds after the repair. |
What the reviewer attaches
Record the actual revision, commands, environment, and results when the checks run. Link the changed authorization path and relevant tests. Check that logs describe the failed action without exposing invitation tokens or unnecessary personal data. Record unavailable checks as open work with an owner.
Approval question
Can another engineer reproduce the denial and explain why B stays untouched? Until the repair and its evidence answer that question, the review stays open. A green build alone cannot close this finding.
Use the AI software toolkit scorecard for a broader assessment. This record belongs beside the change being reviewed. Return to Guardrails.