Boundary Check

Define the boundaries on purpose

Name the real actors — an account, a room, a Familiar, a device — only where the system actually treats them differently, and record who owns each resource, who can read or write it, and who is allowed to receive its output. Separate the person making a request from the owner of the data from the audience receiving the result; those three are not always the same identity.

Follow identity from request to effect

Trace a representative action through authorization, lookup, mutation, and delivery, then check the side paths that might skip that route entirely.

• Keys and queries: is an ID globally unique, and does every lookup use the same scope
• Names and paths: is a display name being mistaken for identity
• Caches and indexes: do they preserve scope, or serve yesterday's result to a different reader today
• Delivery: does read access quietly become publish access to a wider audience
• Background jobs: does a retried task remember whose data it was actually working with

Re-check authority as things change

Trace renames, membership changes, revoked access, and restores from backup, and ask what happens to caches, queued work, and signed links issued under the old state. A durable, explicitly scoped grant can be valid; rebuilding authority from a display name that just changed cannot.

Prove it with a real test, not a read-through

Use throwaway test accounts and resources to exercise the real storage and delivery path — two owners with the same local ID, a guessed identifier, a cache warmed by one party and read by another. For each boundary, prove both directions: the unauthorized attempt fails without leaking anything, and the legitimate shared action still works cleanly.

Keep collaboration and leakage visibly different

A denial should never look identical to a broken feature, and an intended shared space should never quietly become the reason data crosses a line nobody agreed to. Preserve deliberate sharing between people and their Familiars while closing the paths nobody designed on purpose.