The scenario
Centralize authorization across reads, updates, lists, and administrative access.
A failure to reason about
A document lookup is scoped correctly, but another application command reaches the same document without the same access check.
Illustrative context for the topic. The exercise’s full requirements arrive in the workspace.
Questions to bring to your review
- Which caller makes the reported behavior visible?
- What focused regression would distinguish the current behavior from the requirement?
- What existing behavior must remain intact after the change?
Skills you will practice
- Authorization
- Multi-tenancy
- Information disclosure
Read the existing code, reproduce the reported behavior, review proposed changes, and verify your final implementation. You can use AI assistance while staying responsible for the result.
Prepare with a worked example
- How to review AI-generated code
A worked review of a cache patch: establish the contract, find a counterexample, verify the fix, and explain the evidence.
See how nrml evaluates an attempt, including the limits of automated evidence.