Your activity feed can show events from records the viewer can't open
A
Practical lessons on auth, authorization, and access control.
Activity feeds often pull from an events table ordered by created_at, scoped by workspace_id. The event row stores a title snapshot and a record_id. The feed renders the snapshot without checking whether the viewer can still read that record.
Someone loses access to a deal. The feed still shows "Priya updated Acme renewal (legal hold)" because the event row never rechecks.
When you build the feed for a viewer, run the same read check you use on the record page for each event's target. Drop events that fail. Don't keep a greyed-out row that still shows the title.
Quick test: grant access, generate a few events, revoke access, reload the feed. If those events still appear with titles, the feed skipped the check.