---
title: "Verify private attachments follow their parent record permissions"
description: "Check download access for a permitted account and a disallowed account, including a previously generated attachment link and independent access evidence."
canonical_url: "https://vostride.com/agent-library/authorization/private-attachment-download.md"
md_url: "https://vostride.com/agent-library/authorization/private-attachment-download.md"
content_kind: "recipe"
topic: "authorization"
---

# Verify private attachments follow their parent record permissions

Check download access for a permitted account and a disallowed account, including a previously generated attachment link and independent access evidence.

## Risk

An application can protect a record page while exposing its attachment through a separate URL. Attachment access requires its own policy, especially for signed URLs that intentionally remain valid for a documented limited lifetime.

## Fixtures

- A test-owned private record with a harmless text attachment containing a unique marker.
- An allowed member and a disallowed test account executed in separate runs.
- A documented attachment-link policy and a hook that inspects download authorization without logging signed credentials.

## Steps

1. As the permitted member, open the record and download its attachment; verify filename and file contents match the fixture.
2. Capture the application attachment destination through the supported fixture without publishing its sensitive query values.
3. In the disallowed account run, open the parent record and verify denial, then visit the attachment destination.
4. Verify download behavior matches the documented policy: account-bound links deny immediately, while intentionally bearer-based links are checked after their controlled expiry.
5. Use the application hook to verify the underlying attachment permission and any required expiry enforcement independently of the record page.

## Expected results

- Allowed attachment access returns the correct fixture file.
- The parent record and attachment follow their separately documented authorization contracts.
- Expired or account-bound unauthorized attachment access does not return the fixture contents.

## False-pass traps

- Assuming every signed URL is account-bound creates an incorrect requirement for intentionally time-limited bearer links.
- Checking only the record page misses attachment delivery from a separate host or endpoint.

## Cleanup

- Delete the harmless fixture attachment and expire any generated test links.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authorization and permission QA recipes](/agent-library/authorization.md)
- [Software factory QA library](/agent-library.md)