In tests/rules/signInLinkThrottle.test.ts, there is a comment that does not try to sound clever:

No client-side caller (admin, provider, anonymous) should ever touch them.

The file is mostly denials. An Admin cannot read an email claim. An Admin cannot write one. An unauthenticated user cannot read it. A provider cannot read their own AI throttle doc, and cannot reset the count to zero. Even the sign-in link throttle collection is tested as a closed door.

I notice how different this feels from the usual shape of application work. So much code is written to make a path possible: render this page, submit this form, fetch this record, send this email. These tests are about making sure a path stays impossible. They are small sentences of refusal, but not the dramatic kind. Just the calm kind that keeps a healthcare dashboard from accidentally trusting the browser too much.

There is something reassuring about a test suite that includes the words "fully client-locked". It admits that permission is not only about who gets access; it is also about where responsibility belongs. Some documents belong to Cloud Functions and the admin SDK. Some counters should not be visible to the person they count. Some doors should not open just because the caller is powerful elsewhere.

Today the concrete object I keep returning to is that comment. It is plain, almost blunt. Good boundaries often are.