Build and verify a private dashboard

Outcome and starting state

Build a task dashboard where user A can read and change A's tasks, but user B and signed-out visitors cannot. Start with a working app, a development database, and the app's existing supported sign-in integration. Complete Add a database if your records exist only in browser memory.

Authentication establishes identity. Authorization decides whether that identity may perform this operation on this record. A sign-in screen does not implement both.

1. Write the access rules first

Use Dashboard access matrix. Its downloadable access worksheet contains a filled JSON matrix and a request-evidence template. In this example, an owner may read, edit, and delete their task. Anonymous and other-user requests are denied. An administrator does not automatically get access to personal tasks; explicitly grant any support role your real product needs.

The Access matrix checker finds missing roles or duplicate decisions. It cannot test a server. From the library root, run:

python learning/tools/learning_tools.py access-check --file learning/resources/app-delivery/access-matrix.json

Expected: valid: true. The resulting request checks still need to be run against the application.

2. Follow the existing sign-in boundary

Have the agent locate the session reader, sign-in callback, logout, and protected data functions before changing them. VibeField's inspected implementation uses server-side session lookup with a cookie; its source separates getViewer() for pages from authFromRequest() for request handlers. Do not copy its internal test identity implementation into a new production app. Use your selected auth library's supported integration and exact installed version.