# Shiny: preserve requirements through advanced agent edits

- [Check Shiny session authorization inside the write observer](https://frameworkrecipes.dev/shiny/session-scoped-mutation/guide.md): A hidden button is not permission enforcement. A Shiny observer can be triggered by a client input, so the write boundary must check the session’s verified permission and carry its tenant/user scope into the persistence adapter.
- [write-observer-checks-permission rule pack](https://reporules.fyi/shiny/session-scoped-mutation/rule-pack.zip): YAML requirement and agent task.
- [Remove Shiny’s session-owned temporary files on session end](https://frameworkrecipes.dev/shiny/session-temp-cleanup/guide.md): Session reports can contain private data and consume disk after the browser disconnects. Give each session its own directory and register cleanup with that session’s owner. A shared fixed path permits one session to overwrite or delete another’s report.
- [session-removes-report-workspace rule pack](https://reporules.fyi/shiny/session-temp-cleanup/rule-pack.zip): YAML requirement and agent task.
- [Framework rule pack](https://reporules.fyi/shiny/rule-pack.zip): All requirements from this framework site.