---
title: "Verify a release permission migration preserves account boundaries"
description: "Test sandbox roles after a prepared release migration, checking one allowed action and one forbidden path against independently recorded grants."
canonical_url: "https://vostride.com/agent-library/release-regression/permission-migration-retains-boundaries.md"
md_url: "https://vostride.com/agent-library/release-regression/permission-migration-retains-boundaries.md"
content_kind: "recipe"
topic: "release-regression"
---

# Verify a release permission migration preserves account boundaries

Test sandbox roles after a prepared release migration, checking one allowed action and one forbidden path against independently recorded grants.

## Risk

New permissions can default too broadly or make established roles unusable. A useful migration test needs both positive and negative evidence for the same migrated account, with authoritative grants captured before and after.

## Fixtures

- An owned sandbox snapshot migrated externally from the previous release with a disposable editor and viewer account.
- A baseline permission manifest defining which role can edit a shared task and which must remain read-only.
- A read-only post-migration grant and task-revision oracle; separate product sessions are prepared for the two test accounts.

## Steps

1. Open the task as the migrated editor, verify the account identity, edit its description, and verify the accepted change after reopening.
2. Open the same task in the prepared viewer session and verify the updated description is readable while edit controls follow the read-only contract.
3. Attempt the saved editor route through the viewer product session and verify the documented access-denied or read-only outcome without changing task content.
4. Inspect the independent grants and revision oracle and verify roles match the migration policy and only the editor created an accepted task revision.

## Expected results

- The migrated editor retains the intended allowed capability.
- The migrated viewer cannot perform the same mutation through navigation or a saved route.
- Persistent grants and accepted revisions preserve the recorded account boundary.

## False-pass traps

- Testing only forbidden actions can pass when the migration accidentally disables everyone.
- A hidden edit button does not prove that a saved editor route enforces the same boundary.

## Cleanup

- Restore the task description and retire the isolated migrated account sessions.

## Use with agent-qa

Adapt this test design to your application's acceptance criteria and configured target using the [recipe execution guide](/agent-library/software-factory/turn-a-recipe-into-an-agent-qa-test.md). External fixture setup and non-UI checks require your own supported hooks or test tooling. Validate the authored test, execute it, and inspect the completed evidence; this recipe is not a recorded test result.

## References

- [agent-qa first test](/docs/agent-qa/guides/first-test.md)
- [agent-qa hooks](/docs/agent-qa/guides/hooks.md)
- [agent-qa test](/docs/agent-qa/configuration/test.md)

- [Release regression QA recipes](/agent-library/release-regression.md)
- [Software factory QA library](/agent-library.md)