From permission boundaries to reviewable delivery

01 / Hiding a button does not remove a resource

An archive interface can reduce permissions to menu visibility: teachers see upload, administrators see review. Yet copied links, altered file IDs and exports bypass the original page. Start with what this actor may do to this resource, then decide how to present it. Authorization must cover reading, downloading and exporting.

02 / Evaluate role, ownership and state together

The archive case records teacher access to personal files, administrative queries scoped to the actor's college, and a shared query scope for lists, CSV and print manifests. Versions describe content evolution; review states describe acceptability. The counselor system further separates personal, class, college and student-care visibility. A single signed-in check cannot express these boundaries.

Progress at 100% also does not replace approval. The frontend may explain the next action, but the backend still checks role, ownership and current workflow state so an old page cannot submit a stale action.

03 / Turn permission rules into a counterexample matrix

The matrix below is a minimal proposal derived from the archive rules, not an existing test result. For each row, check lists, details, downloads and exports, then add signed-out and expired-session cases. Direct API requests matter: a record being absent from the page does not prove the backend rejects access.

Proposed archive checks; synthetic actors/resources
Actor             Resource                    Expected
Teacher A         own file / college X        allow read
Teacher A         Teacher B file / college X  deny read
Administrator X   file / college X            allow scoped read
Administrator X   file / college Y            deny read
Teacher A         own pending file            deny review

Repeat each applicable read check across:
list -> detail -> download -> export

The matrix targets inconsistent decisions across entry points. Review states, deletion states and field-level visibility require further cases.

04 / Shared rules reduce drift but concentrate risk

Reusing query scope reduces the chance that an export omits a college restriction, but a defect in the shared function also spreads further. A useful combination is centralized policy, enforcement at API boundaries and cross-role counterexamples at callers. Attachment access must resolve its parent resource rather than trust a filename or download link.

Archive database transactions do not include disk writes. The reviewed implementation removes a newly written file when metadata insertion fails, while process interruption and orphan cleanup remain concerns. Logical deletion and operation logs provide a basis for tracing actions without automatically providing tamper-resistant auditing.

05 / Tie acceptance evidence to the delivered version

The counselor release case binds SHA-256 digests of the backend, production frontend and browser report to an acceptance summary. Digests are recalculated before packaging and checked after copying. The public pure-function example rejects changed artifacts, skipped browser checks, incomplete restart evidence and malformed summaries. Its rule evaluation should be distinguished from complete deployment validation.

Acceptance: backend=A, frontend=B, browser-report=C
Before packaging: backend=A, frontend=D, browser-report=C
Decision: reject; frontend changed after acceptance
Next step: inspect the change, rebuild and repeat relevant checks

Matching hashes support artifact consistency; they do not prove report authenticity or grant permission to release.

06 / Make the next step independently reviewable

Historical counselor records include 17 browser checks and 18 packaging-protection checks; they were not rerun for this note. Concurrent archive version increments, production deployment and real roster migration remain outside those conclusions. Publishing synthetic role fixtures, failure assertions and artifact manifests would let a reader inspect a small but complete boundary before discussing improvements in efficiency or reliability.