# Permission escalation via role change: pre-release checklist

Source: https://releasefailures.com/incidents/permission-escalation-via-role-change/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A role or policy change grants users access to resources they should not see.
- [ ] PR-01 Run the team permission tests with every performance flag both on and off, and assert that a non-member sees zero rows from a private team in both states. (test class: Integration tests)
- [ ] PR-02 Assert that a query reaching the data layer without a team-level filter raises an error instead of returning rows. (test class: Integration tests)
- [ ] PR-03 Render the digest email for a member of one team and assert that it lists no activity from private teams the member does not belong to. (test class: Integration tests)
- [ ] PR-04 In a tenant with at least two Spaces, fetch Space data as a user who belongs to only one and assert that the other is denied. (test class: Integration tests)
- [ ] PR-05 Enumerate every endpoint route and fail the build if any route lacks an authorization policy attribute. (test class: Security tests)
- [ ] PR-06 Request every admin settings endpoint, including pages hidden from the sidebar, as a non-admin user and assert a 403 Forbidden response. (test class: Security tests)
- [ ] PR-07 Run the permission synchronization on a staging copy before production and assert that no guest or external account receives a grant to an internal project. (test class: Security tests)