AddThisFeature

Permission-Aware Route Fallbacks

Send people somewhere useful when a page exists but they cannot open it.

moderate Security & Reliability

What it adds

Access denials that distinguish why the user was blocked and route them to something they can actually do.

What your agent is told to do

5
  1. 1

    Enumerate the reasons a route can be refused: signed out, expired session, wrong workspace, insufficient role, suspended account, unpaid plan.

  2. 2

    Give each its own response and its own next action. Sign in, switch workspace, request access, contact an admin, and upgrade are all different fixes.

  3. 3

    For sensitive resources, return the same not-found response whether the record is missing or merely forbidden, so existence is not disclosed.

  4. 4

    Capture the intended destination before redirecting to sign-in and return the user there afterwards.

  5. 5

    Do NOT render a blank page or bounce to the dashboard with no explanation. Silent redirects read as bugs and generate support tickets.

Edge cases it handles

7
  • A validated return URL only. An open redirect parameter is a phishing vector, so reject anything not internal to the app.
  • Redirect loops happen when the fallback destination is itself forbidden. Cap the chain and fall through to a guaranteed-safe page.
  • An expired session on a POST must not lose the user's input. Preserve it or tell them plainly that it was not saved.
  • Do not leak record names, counts, or workspace details in the denial message for resources the user cannot see.
  • API and page routes need different responses. A fetch must get a status code, not an HTML sign-in page.
  • Where a request-access flow exists, route the user into it rather than dead-ending at 'forbidden'.
  • Deep links shared between colleagues in different workspaces should offer to switch workspace rather than simply refusing.

Definition of done

8
  • Each denial reason produces a distinct response with a specific next action.
  • Sensitive forbidden resources are indistinguishable from missing ones.
  • The intended destination survives sign-in and is validated as internal before use.
  • No route chain can loop; a guaranteed-safe fallback always terminates it.
  • API requests receive status codes rather than redirects to HTML.
  • Denial messages disclose nothing about the resource itself.
  • The feature matches the existing design system.
  • No existing functionality is broken.

Related features

How it works

  1. 1

    Copy the link

    Grab the Markdown instruction URL for this feature.

  2. 2

    Give it to your AI

    Paste it into Claude Code, Cursor, v0, Lovable — whatever you build with.

  3. 3

    It inspects, then implements

    Your agent reads your existing app first, then adds the feature to fit it.

Works with your stack

These instructions are written to adapt. They tell the agent to detect your framework, match your existing design system, and reuse what you already have — rather than assuming a particular stack.

Need it tighter than that? Customize the feature and tell it exactly what you're running.