One note, followed from the afternoon it was learned to the day it stopped needing to be remembered. The learning loop sounds abstract until you watch a single lesson earn its place.
The lesson
On a multi-tenant application, the rule that a client can only see their own records lives in the database as a policy. Alongside the policies are grants: which roles may read or write which tables and columns. The hosted database we use grants full access on every table to signed-in users by default.
While tightening one table, I added a narrower grant: signed-in users may update this one column. The intention was obvious. The effect was nothing. Grants in this database are additive, so the narrower grant sat beside the broad default and changed no behaviour at all. Every column stayed writable.
I found out because a test of the policies failed. Not a bug report, not a customer. A test. That is the only acceptable way to find out.
The note
That afternoon it became a note. One idea: column-level grants are additive, not restrictive; a narrower grant is a no-op until the table-level grant is revoked first. The symptom, the mechanism, the fix, and a link to the note about putting authorization in the database in the first place. The index line was written for a stranger with the same problem: the symptom they would search for, the stack they would be on.
What happened next
Nothing, for a while. That is the point.
Weeks later, on a different project, a new session started the way every session does: the index was loaded into the tool’s context before any work began. The task involved tightening permissions on a table. The tool proposed the change and, unprompted, included the revoke before the narrower grant, citing the note. I had not remembered the note. The tool had matched the hook.
Then the project setup itself changed. The new-project routine, which creates the accounts and the first migration for any new build, now includes the correct grant shape from the start. The lesson is no longer even a thing to remember at the right moment. It is in the template.
The three properties, in one note
- Repeatable: written once, the same afternoon it was learned.
- Automatically applied: surfaced by the index in a session that did not go looking for it.
- Continually improved: promoted from a gotcha to a default in the project template, and the note now says so.
Multiply that by every lesson a team learns in a year of working with AI tools. That is the gap between a company that gets faster once and a company that gets faster every month.