A role change quietly gives employees admin rights
One line in the role hierarchy, and employees can open the invoices. No screen shows it.
- Employee
Why ordinary tests miss it
Role hierarchies live in one place and are used everywhere. Widening a role is a one-line change that passes review, and nothing on screen changes, because the menu still hides what the API now allows.
Set it up
New flow, then “Tour for a role”, and pick Employee. The tour shows what the role may do, read from your code, and up to five things it may not do, each with a check that the call is refused with 403.
Run it against the mock first: the mock refuses what the code refuses, so the tour passes.
Run the tour on acceptance with the deploy hook after each deploy, and monitor it on production.
The moment it’s caught
-
✓
Employee
GET /api/products200 -
✓
Employee
POST /api/orders201 -
✗
Employee
GET /api/invoices✗ Status is 403 (got 200)
The step that should have been refused fails, so the change is caught on the deploy that made it, not in a security review months later.
What you use
Next case: The frontend team waits for an API that isn’t deployed yet
Catch this one in your own product
Connect a repository, describe the journey, and run it against the mock in a few minutes.