An AI startup building a trading and document-intelligence platform had an in-app assistant, built on the Claude Agent SDK with in-process MCP tools, that could update records regardless of the user's role. Role checks lived only in the HTTP middleware; the agent called shared services directly. Separately, its trade-confirmation approvals engine was broken end to end for an enterprise design partner: no notifications, contracts never activated, no stale-decision or concurrency guards, and no way to resubmit after a rejection.
Agent security audit: traced the agent's ~80 tools against the permission layer and wrote up five findings framed as OWASP LLM06 (excessive agency): write-path bypass, read-path exposure within a tenant, an open prompt-injection surface through attachments and email content, guardrails that weren't permission checks, and unguarded task-agent handlers. The plan adds a central gate in the tool wrapper that reuses the product's existing permission primitive, then parity tests.
Approvals epic: I audited the engine against the user-journey spec and wrote the gap analysis the engineering lead cut into 27 tickets, all assigned to me. I built a grouped approval-request model with revisions and resubmit, auto-activation, role notifications, a trigger-maintained content version for stale-decision protection, clean concurrency errors, and an approver view that reuses the trade form with the AI assistant alongside it.
I also shipped about 25 accounting and invoicing PRs and a public reporting API with a self-describing data-completeness catalog.
Claude Agent SDK, MCP, E2B, Next.js 16, React 19, TypeScript, Drizzle ORM, PostgreSQL / Supabase (RLS, triggers), Zod, Trigger.dev, shadcn/ui, Jest, Vitest, Playwright
Audit and implementation plan delivered to the engineering leads in August 2026. The consolidated approvals feature PR was merged to main on August 2, 2026, with follow-up fixes through late August.