A multi-step wizard can finish with access checked only on step oneLong create or edit flows often authorize once when the wizard opens. Later steps trust that first decision and write on submit. Access can change while the user is still on step three: someone remove11SOct 16 · 1 min readauthbyexample.hashnode.dev
Removing someone from an IdP group can leave their local app roles untouchedMost SaaS apps treat SSO group membership as the source of truth for roles. A nightly or webhook sync maps IdP groups to local roles and writes them onto the user record. Deprovisioning is often incom11SOct 16 · 2 min readauthbyexample.hashnode.dev
Webhook retries can keep firing after the subscription was revokedMost apps queue failed webhook deliveries and retry them for hours or days. The worker pulls from that queue by subscription_id and POSTs the stored payload. It rarely checks whether the subscription 11SOct 16 · 1 min readauthbyexample.hashnode.dev
A create form can prefill values from fields the user is not allowed to read"Duplicate as draft" and "create from template" endpoints often load the source record, copy every column into the new draft, and return that payload to the create form. Field-level read rules on the 1Oct 15 · 1 min readauthbyexample.hashnode.dev
Cloning a record can copy share grants the cloner could never createClone and duplicate endpoints often copy the source row, then copy its ACL or share table in the same transaction. The share dialog already stops that user from adding certain people or roles, but the1Oct 15 · 2 min readauthbyexample.hashnode.dev
