A permission key that enforced nothing

August 5, 2026 · The Kemble team

Kemble had a permission called space.moderate. It was in the catalogue, it was granted to the Moderator role template, it appeared in the role editor, and a search of the server for its name returned the catalogue and the template — and nothing else. No route checked it. It granted precisely nothing.

This is a specific and quiet kind of bug. Nothing is broken, no test fails, and the permission UI is not lying about anything a reviewer can see. It just describes an authority that does not exist.

The same shape, three times

We found it elsewhere in the same audit. Eight webhook event types were offered and one was ever emitted. A per-organization AI token quota was read on the enforcement path and written by no endpoint. Notification preferences were stored, resolved by a function with no callers, and consumed by nothing.

Each one had the same cause: two halves of a feature landing in different changes, and the second half never landing.

The rule

A declaration and its enforcement ship in one commit or neither ships. A webhook event type is added in the same change as its producer. A permission key is added in the same change as the route that checks it. A stored preference is added in the same change as the code that reads it.