diff --git a/docs/plans/2026-08-04-authz-permissions-implementation.md b/docs/plans/2026-08-04-authz-permissions-implementation.md
index 00fee161..5f2ae3b4 100644
--- a/docs/plans/2026-08-04-authz-permissions-implementation.md
+++ b/docs/plans/2026-08-04-authz-permissions-implementation.md
@@ -1329,7 +1329,9 @@ describe("createAuthzResolver.decide", () => {
 
   test("denials are audited and allows are not, by default", async () => {
     const { store, audit, resolver } = make();
-    await store.assignRole("u1", "editor");
+    // moderator, NOT editor: editor holds "post:*", which legitimately grants
+    // post:delete, so that call would be an allow and nothing would be audited.
+    await store.assignRole("u1", "moderator");
     await resolver.decide({ subject: { id: "u1" }, permission: "post:delete" });
     await resolver.decide({ subject: { id: "u1" }, permission: "post:read" });
     expect(audit.events).toHaveLength(1);