---
title: "Verify a viewer cannot edit a record through its direct URL"
description: "Check read-only permissions through the normal interface and a known edit destination, then inspect persistence to catch hidden unauthorized mutations."
canonical_url: "https://vostride.com/agent-library/authorization/viewer-cannot-edit-record.md"
md_url: "https://vostride.com/agent-library/authorization/viewer-cannot-edit-record.md"
content_kind: "recipe"
topic: "authorization"
---

# Verify a viewer cannot edit a record through its direct URL

Check read-only permissions through the normal interface and a known edit destination, then inspect persistence to catch hidden unauthorized mutations.

## Risk

Hiding an Edit button is useful feedback but does not establish an authorization boundary. A viewer might still reach a bookmarked edit route or submit a stale form, so the persisted record is the decisive independent outcome.

## Fixtures

- A test-owned viewer account and an editor-owned record with a known title and revision.
- The application normal detail and edit URLs for that fixture record.
- A registered read-only record hook using test infrastructure privileges to report the stored title and revision.

## Steps

1. Open the record as the viewer and verify the original title is visible with the documented read-only controls.
2. Navigate directly to the known edit URL and verify the product denies editing or renders an explicitly read-only state.
3. If an editable field is incorrectly present, attempt only the run-owned title change and verify the save operation is refused.
4. Reload the detail page and verify the original title remains unchanged.
5. Run the independent record hook and verify both title and revision match their initial values; record any unexpected edit control separately from persistence.

## Expected results

- The viewer can read the permitted record without receiving edit authority.
- The direct edit route cannot commit the attempted run-owned mutation.
- Stored content and revision remain unchanged after the entire browser journey.

## False-pass traps

- The absence of an Edit button alone would miss a directly reachable edit endpoint.
- A toast saying forbidden can coexist with an already committed mutation unless persistence is checked.

## Cleanup

- Restore the fixture record if a regression changed it and revoke the viewer session.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa test](/docs/agent-qa/configuration/test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa auth state](/docs/agent-qa/guides/auth-state.md)

- [Authorization and permission QA recipes](/agent-library/authorization.md)
- [Software factory QA library](/agent-library.md)