Identity, authorization and privacy at every operation
Why UI permissions are not authority
A hidden button does not protect its endpoint. Authorize the current actor at the read or write operation using server-owned identity and current permissions. Treat tenant IDs, run IDs and role fields supplied by a browser as claims to verify, not facts.
The workbench's identity selector is a local fixture that intentionally lets anyone choose Alice, Bob or a viewer. Its cookie demonstrates scope transitions; it is not production authentication. Do not expose the server publicly. Replacing this fixture requires a real identity integration, session rotation, expiry, revocation and deployment-specific cookie settings.
Operation boundaries in the fixture
Protected routes resolve the actor and verify ownership. Approval reads current permission again instead of trusting the role captured when a run was created. The persisted proposal hash binds approval to exact content. A revised proposal invalidates an old approval. Tests revoke the actor before execution and assert no action is recorded.
POST endpoints require a same-origin/custom-header contract in the local BFF. This is a constrained CSRF defense for that application; production cookie, proxy, origin and CORS configuration must be reviewed together. CORS controls browser response access and is not a general authorization mechanism. Native form endpoints need their own CSRF design, as demonstrated separately in the Worker.
Untrusted rendering and data boundaries
Render retrieved text as text. Validate URLs and allow only intended schemes and destinations. A safe scheme check does not make every HTTPS destination trustworthy; redirect, attachment and tool-download flows need destination policy and SSRF protection on the server. Never let model output choose arbitrary React component imports or executable HTML.
CSP reduces some injection impact but does not excuse unsafe rendering. Design nonce/hash and script delivery around actual framework behavior. Third-party scripts cross a substantial trust boundary: inventory owner, purpose, data access, consent requirements, failure behavior and removal path.
Privacy-aware evidence
Log correlation IDs, operation categories, release and outcome; avoid challenge tokens, credentials, full prompts or personal form payloads by default. Define retention and deletion across primary storage, caches, search indexes and logs. Deleting a document from the source is incomplete if retrieval continues returning an old indexed copy.
The synthetic fixtures contain no real customer records. Existing case-study numbers without a source should be treated as illustrative until provenance is established. Do not turn teaching data into claimed production outcomes.
Exercise and rollout
Call a write endpoint directly as a viewer, request another tenant's run, revise after approval, and revoke permission before execution. Each denial must leave the side-effect count unchanged. Test logout and account switch against every browser storage layer. A strong answer distinguishes authentication, authorization, CSRF, bot mitigation and idempotency. Roll out new permission logic in observable slices, but never use an allow-all fallback when the authority is unavailable.
Executable reference and sources
Implementation · Behavioral evidence · Primary source.
Run the projects and assessment. Human review is pending.