
Write the authorisation tests before the fix: one matrix, every endpoint, every caller
Agents add endpoints that work and forget who may call them. A single xUnit theory and a route-coverage guard make that a red build. About 20 minutes to set up.
9 min read