Testing guards with the real thing, not a mock
Guards read decorator metadata, so testing them against a mocked Reflector asserts the mock's idea of the decorators rather than what they actually say.
The safety net had a hole
The test, the audit log, the scanner, the CI run — covering less than I assumed it did.
While building out auth coverage, I deliberately tested the guard chain against a real Reflector rather than a mock. Guards are almost entirely about reading decorator metadata, so a mocked reflector tests the mock's idea of what the decorators say — which is exactly the thing that can drift from what they actually say. That's the difference between a test that would catch a mis-applied @Superadmin() and one that wouldn't.