Test invoice ownership with two accounts before accepting an AI fix
At a glance
A nontechnical founder gives his coding assistant concrete cross-account failures and checks that the repair actually blocks them. This workflow is listed under Testing, AI Coding, Access Control.
- Agents / tools
- AI coding assistant, CLAUDE.md
SourceBuilding a tool for these workflows? See weekly rates.
What they did
1) Use two test accounts you control in the invoicing application, with a client and invoice belonging to account A. Keep the coding assistant connected to the project. 2) Sign in as account B and try the direct invoice URL and associated request belonging to A. Record the actual response and whether another account's details are exposed. 3) Give the assistant the reproduction and the expected ownership rule: B must be refused access to A's resources. Have it repair the missing check. 4) Repeat the same request and verify refusal. Add a regression test for that failure and preserve project rules in CLAUDE.md across sessions. 5) Temporarily remove the ownership guard to verify that the test fails, then restore the guard and rerun the checks before accepting the change.
How it went
In follow-up comments, the author reports reproducing cross-account exposure, fixing it, and confirming that the same request was then forbidden.
