07.05 · Walkthrough
Directing & Auditing an Agent That Builds Auth
Specify a user system to a coding agent precisely enough to be built, then review what it wrote for the four failures this course names.
Agent-built authentication needs a security specification, not a UI request. The prompt must define identity, sessions, protected routes, roles, data access, recovery, revocation, and forbidden shortcuts. The review then checks whether the server, database, and session layer enforce rules against hostile clients, not just whether the browser flow succeeds.
What this lesson answers
- how to prompt an agent to build auth
- how to audit agent generated authentication code
- what auth checks must not live in the client
Notes
When you ask a coding agent to build authentication, you are not just asking for login screens. You are specifying a security boundary: how identities are created, verified, stored, authorized, recovered, and revoked. A good prompt names the product behavior, the data model, the trust assumptions, the protected routes, the session mechanism, and the unacceptable shortcuts, such as plaintext passwords, client-only authorization, or hidden admin flags in local storage.
The useful mental model is that the agent is a fast junior engineer: it can produce a lot of plausible code, but it will…
Common questions
- What should I include when asking an agent to build authentication?
- Specify the product flows, identity model, session mechanism, protected routes, role rules, database ownership rules, recovery flow, logout behaviour, and secrets handling. Also state forbidden approaches, such as plaintext passwords, local-storage admin flags, and authorisation that only hides UI. Give the agent acceptance checks, not just feature descriptions.
- Why is client-side authorisation not enough?
- Client checks only guide the interface. An attacker can bypass the UI, call APIs directly, alter requests, replay tokens, inspect bundled code, and guess object identifiers. Authorisation must be enforced where the data is served or stored, so the same rules apply even when the browser is treated as untrusted.
- What are the main risks in agent-written auth code?
- The common failures are weak identity verification, authorisation implemented only in the client, unsafe session or secret handling, and data rules that let users read or modify another user’s records. Agent output can look complete while missing these controls, so the audit must follow the trust boundaries, not the screens.
Short definition: what is Directing & Auditing an Agent That Builds Auth?