Security / Studio journal
Three permission checks for a new API
Start without a session
Call a private endpoint without signing in. Confirm that it returns a deliberate denial and no private fields.
Try the same action as another user
Use two test accounts with separate records. Change the record identifier and verify that account A cannot read or modify account B’s data.
Test the write path separately
A protected page does not protect its API. Repeat the tests against create, update and delete operations, and record the expected status for each.