---
title: "Verify unverified accounts cannot bypass the verification gate"
description: "Exercise sign-in and direct navigation before email verification, then complete a run-specific verification link and confirm the intended access change."
canonical_url: "https://vostride.com/agent-library/authentication/unverified-email-gate.md"
md_url: "https://vostride.com/agent-library/authentication/unverified-email-gate.md"
content_kind: "recipe"
topic: "authentication"
---

# Verify unverified accounts cannot bypass the verification gate

Exercise sign-in and direct navigation before email verification, then complete a run-specific verification link and confirm the intended access change.

## Risk

Products that require verified email must enforce the rule on protected actions, not just display a reminder banner. The test separates limited account creation from permission to use the gated capability.

## Fixtures

- A newly created test-owned account whose email is deliberately unverified.
- A test inbox and a gated action such as creating a production-like workspace in the sandbox.
- A documented verification policy and an account-state hook exposing only the verification flag and created resource count.

## Steps

1. Sign in with the unverified account and verify the verification reminder or limited-access page specified by the product.
2. Open the gated creation URL directly and attempt the visible action; verify it remains blocked and explains the verification requirement.
3. Run the state hook and verify the account remains unverified and no workspace was created.
4. Request a verification message, obtain the exact run-specific link from the test inbox, and complete it; verify the browser acknowledges verification.
5. Return to the gated action and create the uniquely named fixture workspace; verify it appears after reload and that the state hook reports verified email.

## Expected results

- Unverified authentication does not imply permission to perform the gated action.
- Verification changes the intended account flag only after the valid inbox link is consumed.
- The permitted post-verification action creates exactly the intended workspace.

## False-pass traps

- A reminder banner can remain visible while the supposedly gated action succeeds underneath it.
- A preverified seed account removes the negative state that gives this scenario value.

## Cleanup

- Delete the run-owned workspace, account, and verification messages from the test inbox.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](/agent-library/authentication.md)
- [Software factory QA library](/agent-library.md)