01 · Before and afterThe pattern
// before: coarse project check, then return every match
await assertCan(actor, "ListSecrets", project);
return findSecretsWithValue(digest(value));
// after: an explicit, org-level grant for the cross-boundary capability
await assertOrgCan(actor, "SearchValuesAcrossProjects"); // 403 otherwise
return findSecretsWithValue(digest(value));02 · Run it on your appThe check
Do any of your “exists / duplicate / match” endpoints tell users about records they are not allowed to read?
If the honest answer is no or not sure, this is worth a look before it reaches production.