Security features get worse when they surprise people. In Generations and Reflections, I built a session monitor that warned before sign-out, let the user extend the session with a small interaction, and fixed the timer bugs that could have signed them out anyway.

At Skillit, I needed staff to do real operational work in Avo without giving every staff user superuser powers. Pundit policies turned that into a permission matrix I could reason about.

For a game that could eventually involve real money, hiding future questions can't be a frontend courtesy. It has to be enforced in the GraphQL payload itself.