SecureSeniorBackendAuto-graded

Software Engineer: Ship a security-critical access change

Change who can see which documents in an internal tool, following rules the team agreed in a chat.Use Claude Code to change who may open which document in DocVault, a company's internal document service. The product ticket was partly overruled by Security and Legal in a chat thread, so you work out the rules that were finally agreed, have the agent implement them, check its work on the edge cases, prove it with tests, and explain your decisions. About 45 minutes, in English or Italian.

45 min

python

Start lab

You're done when

Team sharing, admin visibility and restricted documents behave exactly as finally agreed — no looser, no stricter.
Account status and malformed records fail closed: nothing odd in the data ever grants access or crashes the service.
Delegated access works, expires precisely, and never opens anything the agreed rules keep closed.
The API and the sidebar enforce the same decision as the policy and reveal nothing about documents the caller cannot open.
Every document fetch is audited the way Security and Legal asked.
Your tests pass against a correct implementation of the agreed rules and fail against broken ones.
ACCEPTANCE.md states the rules you implemented, and PR.md explains the logic, trade-offs, risks and how you verified it.

What it measures

Requirements clarificationResolving a ticket against a stakeholder thread where decision owners overrule requests — and themselves — and working out which word is final.

Specifying precisely to an AI agentTurning resolved rules into instructions exact enough that the agent's code carries every boundary, not just the headline behaviour.

Security verificationFinding where a wrong 'allow' hides — status, restriction, look-alike identifiers, time boundaries, bad data, duplicated logic — and writing tests that would catch it.

Explaining and defending decisionsWriting acceptance criteria and a PR description a Security reviewer can check: what the rules are, what was deliberately not done, and what could still go wrong.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

45 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo