# The six backend jobs and the access table (free sample)

A free sample from Backends for Agent-Built Apps by PaperChaseWebb. Works with Claude Code, Codex, Cursor or any coding agent.

When you ask an agent to "add a backend", you are asking for six jobs. Name them, or it will build the two it finds interesting.

## The six jobs

| Job | Plain question it answers | What breaks when it is missing |
|---|---|---|
| Store | Where does the data live, and does it survive a restart? | Data vanishes, or lives only in one browser |
| Identify | Who is this person? | Anyone can claim to be anyone |
| Allow | What is this person allowed to read and change? | One user reads another user's records |
| Hold secrets | Where do the keys to paid services live? | A key leaks and someone else spends on it |
| React | What happens when an outside service calls in? | Charges with no order, or one order per retry |
| Run later | What runs on a schedule or after the request ends? | Emails never go out, reports never get built |

## The access table, default deny

Fill this in before the agent writes any access rule. Every cell starts at none.

| Table | Anonymous | Signed-in owner | Signed-in other | Staff | Service (server only) |
|---|---|---|---|---|---|
| profiles | none | read, update own | read public fields | read | all |
| orders | none | read own | none | read | all |
| [table] | | | | | |

Then test as three people: owner, other user and signed out. A single "other user can read" where the table says none is a stop.

## Two rules to paste today

```
Never write sign-in, session, password or token code by hand; use [library].
Every table starts with access denied; write access rules from the access table only.
```

## A check prompt

> Here is the access table [paste]. Write a test script that tries to read and change one record in each table as owner, other user and signed out, and prints pass or fail per cell. Do not change any rules. Show me the output.

The full guide adds five backend shapes and a six-question picker, a BACKEND.md contract file, safe migrations, secrets, idempotent webhooks and jobs, a free tier honesty sheet, live monitoring with a human gate, a rules block and 14 prompts.