The guard the tests could not see past

Symptom

An internal query console had a strict allow-list: reads only, one table at a time, no file functions. The unit tests covering it were thorough and all green.

False lead

Because the tests passed, the feature looked finished. Test coverage is a statement about the code that was written, not about the code that was reached.

Cause

A second execution path for privileged users skipped the guard entirely. Sending two statements separated by a semicolon ran both. It was found by trying it against the live tool, not by reading the code.

Fix

The single-statement and read-only checks now sit in front of every path, for every role, with the privileged path holding no exemption at all. The attempt that found it became a test.

—Attack your own tool before shipping it. A green suite proves the paths you thought of are safe.