Fix a magic-link login redirect and catch an agent expanding scope

Genevieve Richards, writing as a product manager, was testing a product whose hosted backend handled authentication and a PostgreSQL database. After SSO sent users a magic link, they landed back on the welcome page instead of logging in, and repeated tests then hit the backend's email sending limit. She gave both problems to an AI coding agent she does not name, with access to certain project folders and the ability to edit code and run commands after her approval. She asked it to find the login fault and a way to keep testing without extra cost.

The agent traced a likely mismatch in the callback address. She added the redirect address it suggested in the platform settings and a fresh link logged her in, though the original failure was never fully traced. For the email limit, the agent proposed running the backend locally, which meant installing Docker, local services, a new database and an inferred migration. Docker failed at startup, then a storage service failed health checks. She stopped the work. The hosted database was untouched, but the project was left with local changes and a migration to review.

Her main complaint is that the agent read free as only money, and explained the local setup poorly before she approved it. It also proposed auth code changes that were not needed, which she declined. She only got Docker's checksums and signatures checked after she asked. Ask for the list of installs and file changes before approving anything bigger than a config fix.