You Checked the Verb, Not the Noun: Authorization Bugs That Survive Code Review

Slides from the CarolinaCon 2026 talk "You Checked the Verb, Not the Noun: Authorization Bugs That Survive Code Review" (online, 24 October 2026). Most access-control bugs are not missing checks. The check runs, but it asks about the action (the verb) and not about the object it acts on (the noun). The talk walks through five shapes of this bug, each from a published security advisory with a public fix, in CiviForm, CourtListener, CommCare HQ, Nautobot and Arches. It closes with review questions, search patterns and a two-user regression test for finding the same gap in your own code. The method is described in the preprint "Asymmetric Authorization" (doi:10.5281/zenodo.23298713). Speaker notes are not included.