---
title: "Verify signing into another account clears private cached content"
description: "Sign out of one test account and into another in the same browser, then check navigation, cached records, and account labels for identity leakage."
canonical_url: "https://vostride.com/agent-library/authentication/account-switch-cache-isolation.md"
md_url: "https://vostride.com/agent-library/authentication/account-switch-cache-isolation.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify signing into another account clears private cached content

Sign out of one test account and into another in the same browser, then check navigation, cached records, and account labels for identity leakage.

## Risk

An application may replace the account menu while retaining the previous user cached records. This scenario exercises a normal account switch and requires independent private fixture content so accidental cross-account rendering is unmistakable.

## Fixtures

- Two test-owned accounts with distinct private workspaces and disjoint permissions.
- A private record named Only Account Amber and another named Only Account Blue, each with different description markers.
- Read-only fixture hooks confirming neither account can access the other record through the application API.

## Steps

1. Sign in as Amber, visit the private record, and verify its label and description; also open any recent-items view that caches it.
2. Sign out through the application and sign in as Blue within the same browser; verify the account email and workspace name both changed.
3. Open the dashboard, recent-items view, and global search; verify Amber private content does not appear in any result.
4. Navigate to Amber previously visited private URL and verify an access-denied or not-found response without its description.
5. Open Blue own record and reload; verify Blue content remains correct, then run the permission inspection hook for both fixture records.

## Expected results

- Every refreshed account-specific surface belongs to Blue after the switch.
- Previously visited Amber private URLs do not reveal their record contents to Blue.
- The server permission checks agree with the browser evidence of isolation.

## False-pass traps

- A correct avatar can coexist with stale private records elsewhere on the page.
- Using two isolated browser profiles alone will miss cache retained during same-browser account switching.

## Cleanup

- Sign out as Blue and delete the two run-owned private records.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)