---
title: "Verify ordinary members cannot reach administrative actions"
description: "Check administrative navigation and direct routes as an ordinary member, including an attempted harmless fixture action and an unchanged audit record."
canonical_url: "https://vostride.com/agent-library/authorization/admin-route-access-denial.md"
md_url: "https://vostride.com/agent-library/authorization/admin-route-access-denial.md"
content_kind: "recipe"
topic: "authorization"
---

# Verify ordinary members cannot reach administrative actions

Check administrative navigation and direct routes as an ordinary member, including an attempted harmless fixture action and an unchanged audit record.

## Risk

Administrative pages may be absent from navigation yet remain reachable by URL. The test should show that role enforcement protects both the page and its action while preserving normal member functionality.

## Fixtures

- A disposable ordinary member account and a separate setup-only administrator fixture.
- A known organization settings route with a reversible action such as changing a test organization display name.
- A permission hook and audit reader restricted to this fixture organization.

## Steps

1. Sign in as the member and verify the organization name and a permitted everyday workspace page.
2. Inspect normal navigation and verify administrative controls follow the documented visibility policy.
3. Open the known administrative settings route directly and verify the application denies access or displays a member-safe limited view.
4. If a name-edit control appears, attempt the run-owned harmless name change and verify it cannot be saved.
5. Inspect organization state and its audit record through the registered hook; verify the display name is unchanged and no successful administrative change was recorded.

## Expected results

- The member can continue ordinary work in the organization.
- Direct administrative navigation does not grant protected settings access.
- The attempted administrative mutation leaves organization state unchanged.

## False-pass traps

- A hidden sidebar item does not exercise the actual protected route.
- A failed browser click due to a missing selector is not the same evidence as an application permission denial.

## Cleanup

- Restore the display name if a regression modified it and revoke the member session.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authorization and permission QA recipes](/agent-library/authorization.md)
- [Software factory QA library](/agent-library.md)