---
title: "Verify removed members lose access through old bookmarks"
description: "Remove a disposable organization member while retaining a known private bookmark, then verify fresh navigation and application authorization both reject access."
canonical_url: "https://vostride.com/agent-library/authorization/deleted-membership-old-bookmark.md"
md_url: "https://vostride.com/agent-library/authorization/deleted-membership-old-bookmark.md"
content_kind: "recipe"
topic: "authorization"
---

# Verify removed members lose access through old bookmarks

Remove a disposable organization member while retaining a known private bookmark, then verify fresh navigation and application authorization both reject access.

## Risk

Membership removal must invalidate organization access even if a user retains a session and knows a project URL. This journey distinguishes loss of organization membership from total account deletion or a general authentication failure.

## Fixtures

- A test-owned account that belongs to two isolated organizations.
- A private bookmarked record in the organization from which it will be removed and a control record in the other organization.
- Membership and permission inspection hooks with a documented propagation deadline.

## Steps

1. As the member, open the private bookmarked record and verify its fixture marker and organization name.
2. Use the supported setup administrator action or fixture hook to remove the account from that organization only.
3. Confirm removal through the membership hook, then revisit the bookmark through a fresh navigation after the documented deadline.
4. Verify access is denied without the private marker and the removed organization is absent from the organization switcher.
5. Open the control record in the remaining organization and verify it still works; inspect authorization for the removed organization record independently.

## Expected results

- Removal prevents new reads of private resources in the affected organization.
- The account remains valid and retains membership in its unrelated control organization.
- The organization switcher reflects the membership change without granting access through stale navigation.

## False-pass traps

- Deleting or disabling the entire account would conceal whether organization-scoped removal works.
- Testing only the organization switcher misses direct access through a previously known resource URL.

## Cleanup

- Restore the removed fixture membership or delete both isolated organizations if they were created for the run.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authorization and permission QA recipes](/agent-library/authorization.md)
- [Software factory QA library](/agent-library.md)