# SvelteKit: preserve requirements through advanced agent edits

- [Authorize a SvelteKit form action before its conditional write](https://frameworkrecipes.dev/sveltekit/server-action-authorization/guide.md): A protected page load does not protect its form action. Server actions must enforce their own identity and resource scope. Passing the verified tenant into the conditional mutation makes that boundary visible to both the code reviewer and the rule.
- [action-tenant-predicate rule pack](https://reporules.fyi/sveltekit/server-action-authorization/rule-pack.zip): YAML requirement and agent task.
- [Keep SvelteKit private SSR responses out of shared caches](https://frameworkrecipes.dev/sveltekit/private-ssr-state/guide.md): A server module is reused across requests. Returning request-local data is safe; putting it into a module-level store or a shared response cache can expose one user’s orders to another. Explicit response policy helps keep the load result outside shared caches.
- [private-ssr-cache-header rule pack](https://reporules.fyi/sveltekit/private-ssr-state/rule-pack.zip): YAML requirement and agent task.
- [Framework rule pack](https://reporules.fyi/sveltekit/rule-pack.zip): All requirements from this framework site.