---
title: "Verify unverified accounts cannot bypass the verification gate"
description: "Exercise sign-in and direct navigation before email verification, then complete a run-specific verification link and confirm the intended access change."
canonical_url: "https://vostride.com/agent-library/authentication/unverified-email-gate.md"
md_url: "https://vostride.com/agent-library/authentication/unverified-email-gate.md"
content_kind: "recipe"
topic: "authentication"
---

> [Documentation index](https://vostride.com/docs.md) · [Site index](https://vostride.com/llms.txt)
> Follow the Markdown links to read individual pages; the indexes list the available documentation.
> [QA library](https://vostride.com/agent-library.md) / [Authentication QA recipes](https://vostride.com/agent-library/authentication.md)

# Verify unverified accounts cannot bypass the verification gate

Exercise sign-in and direct navigation before email verification, then complete a run-specific verification link and confirm the intended access change.

## Risk

Products that require verified email must enforce the rule on protected actions, not just display a reminder banner. The test separates limited account creation from permission to use the gated capability.

## Fixtures

- A newly created test-owned account whose email is deliberately unverified.
- A test inbox and a gated action such as creating a production-like workspace in the sandbox.
- A documented verification policy and an account-state hook exposing only the verification flag and created resource count.

## Steps

1. Sign in with the unverified account and verify the verification reminder or limited-access page specified by the product.
2. Open the gated creation URL directly and attempt the visible action; verify it remains blocked and explains the verification requirement.
3. Run the state hook and verify the account remains unverified and no workspace was created.
4. Request a verification message, obtain the exact run-specific link from the test inbox, and complete it; verify the browser acknowledges verification.
5. Return to the gated action and create the uniquely named fixture workspace; verify it appears after reload and that the state hook reports verified email.

## Expected results

- Unverified authentication does not imply permission to perform the gated action.
- Verification changes the intended account flag only after the valid inbox link is consumed.
- The permitted post-verification action creates exactly the intended workspace.

## False-pass traps

- A reminder banner can remain visible while the supposedly gated action succeeds underneath it.
- A preverified seed account removes the negative state that gives this scenario value.

## Cleanup

- Delete the run-owned workspace, account, and verification messages from the test inbox.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](https://vostride.com/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](https://vostride.com/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](https://vostride.com/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](https://vostride.com/docs/agent-qa/guides/auth-state.md)

- [Authentication QA recipes](https://vostride.com/agent-library/authentication.md)
- [Software factory QA library](https://vostride.com/agent-library.md)