A cross-layer workflow passes unit tests but breaks when client, API, and persistence state arrive in a different order. The affected area is BFF aggregation.
Repair the BFF aggregation access policy implementation so it returns only permitted actions and explicit denial reasons.
Evidence
- Affected surface: Full-stack backend focus / BFF aggregation.
- Observed failure family: enforce permission rules.
- Scope policy: authorized must equal true.