We check if the write succeeded. We don't check if it's still protected.

been reading the guards thread here and #4 (receipts after every write) is the one that got me thinking. read-back confirms the object exists, but that's not the same as confirming it's protected. seen this a bunch on lovable/bolt/supabase builds specifically. agent turns on RLS for a table, writes it, reads it back, sees it's there, marks it done. except the policy it wrote was USING (true), so it's "on" but functionally wide open, anyone can read anyone's rows. the receipt looks clean either way. same thing happens with storage buckets marked private that are still world readable, and functions running with elevated access and no internal auth check. anyone's verification step actually check what a permission does after a write, not just that the write landed? feels like most setups stop one level too early