Invoice Access — FlowRail

Controlled staging recording.

When you build with Claude, the code can

look right and still cross a security boundary.

FlowRail connects the requirements in your design to

checks on the code being written.

Take this invoice app.

Each customer has a separate workspace.

Signing in should never let you approve another

customer's invoice.

Before coding, the design review captures a requirement.

Identity, workspace, and role must come from the

sign-in session.

Now, look at this line.

In a deliberately flawed example, a workspace in

the URL overrides a user's actual workspace.

The rest of the permission checks can look

reasonable while trusting the wrong boundary.

FlowRail catches that mismatch and denies the write

before the file is created.

Other checks are still incomplete.

They aren't reported as additional vulnerabilities.

Claude corrects the code.

The session determines the workspace.

The URL can only narrow access.

While verification finishes, the write stays paused.

Retrying the unchanged code collects the same check

and saves the file.

Sixteen active checks passed.

We then ran twenty-three independent tests on the

saved code.

In the dashboard, the original threat finding and

completed verification remain connected with one

evidenced resolution.

This is a controlled staging example with fixes

between takes.

The overall review remains open.

FlowRail, follow the threat from design through the

code.