From the Backlog to the Build Log

AI-Assisted .NET Authorization: August 28 - September 3, 2026

What I Worked On

The week opened with a pattern I was tired of writing. Services in GCT, DevNitro, and BlankSite guarded against Insecure Direct Object Reference the same way: authenticate the caller, call a Validate* method that returned a bool, then hand-build a 401 or a 403 depending on which step failed. Three lines, copied into each service, and easy to skip. So I changed GCT to return an AccessCheck object instead. One call carries the requester, the denial, and the right status code. The old Validate* calls are now obsolete, and the compiler flags every place still using them. That turned AI-assisted .NET authorization into the main thread of the week. Intelligent Engineering is about putting the check where the agent cannot skip it, and this was a week of doing that in code.

The second thread was a blueprint upgrade. GlobalCove 2.3.0 shipped with the new guards, so I bumped the BlankSite blueprint and ran the DevNitro Upgrade Blueprint command against the HowdyChad blog. Most of it worked. The version bump did not, and that took some time on Monday.

Around the edges: one ApiKeyResolver now feeds the CLI and the Visual Studio extension, with an environment variable override. I ran the DevNitro CLI on Linux for the first time and tested a new model release against the agent prompts.

What the AI Did Well

The migration was the big win. DevNitro had 44 Validate* call sites across 17 files. The agent moved all of them to Check*, deleted the now-redundant requester lookups, and replaced the hand-rolled 401-or-403 code with access.Denied(). Build clean, 2647 unit tests green, 1972 of 1973 integration tests green. The one failure was mine: a packaged blueprint still referenced the old GlobalCove version.

The better part is what the migration turned up. The agent treated each call site as an audit, and it found holes. One settings service had no authorization on any of its seven methods, including upsert and delete. A user-info save took the target user id from the request body, so any signed-in user could have rewritten another user's profile. Workstream and session methods let any user release or stamp records that were not theirs. Milestones had a two-key hole where a caller could attach someone else's issues to their own milestone. All closed. Record-id paths now return not-found on denial so ids stay non-enumerable. This is the same lesson as security rules that prove themselves: the test writes itself once the framework carries the check.

Monday's upgrade debugging was fast. I described the symptom (code updated, manifest version did not) and the agent traced it through the CLI command, the upgrade engine, and the manifest writer in one session, then fixed it with tests. It also built the feature I asked for on top: when a manifest is missing template parameters, the upgrade now aligns the rendered blueprint against your real files and prints the recovered values for you to paste. It got 15 of 18 right on the blog.

What Needed Correction

Part of the blueprint upgrade command approved modified files but never approved conflicts where the blueprint added a new file, so the manifest update step never ran and the version stayed put. The upgrade engine I built in July had a second problem the run exposed: files the blueprint had not touched were being flagged for review and then reverted by the auto flag. The fix compares the new render against the baseline hash from scaffold time and keeps your edits when they match. A third: the prerelease version fallback dropped the channel and turned preview-0101 into 1.0.1. I created a video talking about that fix.

One sub-agent claimed Moq could not mock a default interface method and left the deprecated mock in place. The lead agent checked the assembly by reflection, found the method was virtual and non-final, and fixed the mock.

The audit is about a third done, and the hit rate so far says I should not assume the rest is clean. Two findings wait on a design decision, because the fix changes a public contract and a status code that library clients see.

Linux: listen mode worked on the first try, but my first chat connected to a listener on my Windows machine instead of the one I picked. I changed the SignalR listener code Thursday and fixed a couple other relay bugs while I was in there.

What Shipped

GCT shipped the AccessCheck guards in 2.3.0. DevNitro and BlankSite moved to them and picked up the IDOR fixes. DevNitro also shipped the centralized ApiKeyResolver, the upgrade fixes, missing-parameter inference, and a prompt update with an autonomous-mode guard after the new model test. The HowdyChad blog upgraded to the new blueprint on GlobalCove 2.3.0 and picked up a Razor <time> attribute fix.

The Numbers

Category	Hours
Content	22h 36m
Testing	9h 2m
Product / Features	5h 52m
Deploy / Infra	0h 17m
Total	37h 48m

Content won the week on hours. Most of that went into a video about moving my old dev box to Linux, which is also how the DevNitro CLI got its real first Linux run outside of WSL. The nine hours of Testing are the migration and audit and just playing around creating apps. Product hours look thin because the agent did most of the typing; the commits across four repos carry more change than the clock suggests, but I definitely wasn't using AI to modify a lot of code this week. I used it to help me install Omarchy. It only took 3 minutes and 11 seconds to install, but it took me 5 hours to get to that point.

Where This Fits in Intelligent Engineering

An agent copies whatever pattern sits in front of it. When the pattern is three lines a developer can skip, the agent can skip it too. Move the check into the framework, make the old path obsolete, and let the compiler refuse the skip. Now the guardrail holds whether a human or an agent wrote the code. A guardrail the compiler enforces is what lets your team trust, support, and scale what the agent writes.

AI-assisted .NET authorization this week meant the agent found holes I had not, and I fixed the tool that upgrades every site I build. Back at it next week.

Curious how this site was built?
Watch the 5-minute walkthrough on YouTube →

September 4, 2026 Build Log: AI-Assisted .NET Authorization Guards and an Upgrade Bug