Write the authorisation tests before the fix: one matrix, every endpoint, every caller

Mon, 02 Nov 2026 11:08:00 +0000

Ask an agent for “an endpoint to delete an invoice” and it will give you an endpoint that deletes an invoice. It will compile, it will pass the test the agent wrote for it, and it will let anyone on the internet call it. Nothing in the request said who may delete, so nothing in the code does.

Authorisation on Tokenise

Write the authorisation tests before the fix: one matrix, every endpoint, every caller