Subtle authorization bugs in a clerk portal patch were missed by the generating session. What often works better?

Subtle authorization bugs in a clerk-portal patch are often missed by the generating session because that session is anchored to the story it used to write the code. Independent reviewer instances that lack the generator's biased context more often notice missing permission checks, confused tenant roles, or IDOR-style gaps in municipal portals. Fresh eyes without the author's narrative are a deliberate architectural choice, not an accident. Longer self-praise prompts inside the same generation session deepen commitment to the original design rather than challenging role boundaries or object-level checks. Deleting all tests so subtle bugs cannot be discussed removes evidence instead of improving detection and leaves clerks exposed. Assuming subtle authz bugs never appear in municipal code is wishful and historically false for clerk and resident portals that mix staff and public roles. Exam caveat: independent review complements—but does not replace—automated authz tests and least-privilege design reviews. Operational check: run an independent review job on portal diffs with an authz-focused rubric, keep generator rationale out of that job's context, and block merge on unresolved authorization findings even when the generator self-rated the patch highly.