Map who can see what before you build

Access bugs start when nobody wrote down who may do what. This worksheet makes you decide first: for each action and role, the expected decision, before your agent builds the dashboard.

The download contains a filled example matrix and a request-evidence template. In the example, an owner may read, edit and delete their task; anonymous and other-user requests are denied; and an administrator does not automatically get access to personal tasks, so you grant any support role your product needs explicitly. The matrix is in the format the access matrix checker reads.

Use the evidence template to record each direct request: method, route, actor, expected status, actual result, and a fresh read showing a denied write changed nothing. Keep raw session tokens out of it. The checker finds missing or contradictory cases; it does not prove your app enforces them, so run each case against the real server operation.

It goes with the Build and verify a private dashboard guide and opens in any text editor. Provider accounts, model weights, GPU compute and hosting are not included.