A role baked into a token outlives the demotion that should end it

Caching a user's role or org membership inside a JWT means a demotion doesn't take effect until that token expires -- sometimes hours or days of stale access.

This is one of the things Multi-Tenant Auth & RBAC Core already handles. Sign-in, organisations, invites and roles — with one customer's data provably unable to reach another's.

Buy for $1492 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

Encoding role or permission claims into a signed token (a JWT) is a common way to avoid a database lookup on every request -- but it means a role change, a removal from an org, or an outright ban doesn't take effect until that specific token expires. An admin demoted to member mid-session keeps admin-level access, silently, for however long the token's lifetime is.

Why this one is easy to get wrong

JWTs are the default answer to "how do I avoid hitting the database on every request" in most auth tutorials, and the staleness problem doesn't show up in any test that checks a role at login time -- it only appears when someone's permissions change while their existing session is still active, which is exactly the scenario most auth test suites don't simulate.

What you get instead

Core decision 12 puts no role or permission claims in the session cookie at all -- the cookie maps to a user id only, and role is read fresh from org_members inside the same transaction as the query it's gating. Promotion, demotion, and removal are effective on the very next request; there's nothing stale to invalidate because nothing about authorization was ever cached in the token.

Source: ARCHITECTURE.md core decision 12 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 12 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

2 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $149 14-day refund if verify.sh fails →