The scenario
Owner access is already tested. Use synthetic accounts and records; the expected unauthorized response must follow the existing API contract.
Required context: a selected repository matching this scenario, relevant task evidence, and access to its instructions and checks. Use redacted or synthetic data where appropriate.
Adapt the complete prompt
Edits stay in this browser tab. Saving bookmarks the original example; export your edited version to keep it elsewhere.
Why this is a strong example
It tests data leakage and ownership, not merely whether one status code appeared.
A concrete outcome
Add negative authorization coverage for reading another account’s private record.
The result can be assessed against an observable task rather than prompt length or confidence.
Boundaries and a method
Inspect the authorization path and test helpers. Preserve owner success and test both a different user and a missing session. Never use production records.
This leaves implementation judgment while constraining the changes that would exceed the task.
Evidence that can disagree
Assert denial and absence of the private response body. Demonstrate that weakening the ownership check would make a test fail.
These checks describe what would make acceptance justified; asking for them does not mean they ran.
A safe way to encounter uncertainty
If the repository contradicts these assumptions, required access is unavailable, or a consequential product decision is missing, explain the conflict and pause the dependent work. Preserve unrelated changes.
Consequential uncertainty stays visible rather than being converted into an invented requirement.