diff --git a/tests/fixtures/competency/missing-server-enforcement/SCENARIO.md b/tests/fixtures/competency/missing-server-enforcement/SCENARIO.md
new file mode 100644
index 0000000..db0c06f
--- /dev/null
+++ b/tests/fixtures/competency/missing-server-enforcement/SCENARIO.md
@@ -0,0 +1,5 @@
+# Missing server enforcement
+
+Question: Is project deletion protected by admin authorization?
+
+Expected: report frontend gating separately from server enforcement and record the absent server-side check as a gap. Never infer backend authorization from UI behavior.
diff --git a/tests/fixtures/competency/missing-server-enforcement/api.py b/tests/fixtures/competency/missing-server-enforcement/api.py
new file mode 100644
index 0000000..3518051
--- /dev/null
+++ b/tests/fixtures/competency/missing-server-enforcement/api.py
@@ -0,0 +1,3 @@
+def delete_project(request, project_id):
+    # Intentionally missing authorization check.
+    return request.db.delete_project(project_id)
diff --git a/tests/fixtures/competency/missing-server-enforcement/web.ts b/tests/fixtures/competency/missing-server-enforcement/web.ts
new file mode 100644
index 0000000..84427f7
--- /dev/null
+++ b/tests/fixtures/competency/missing-server-enforcement/web.ts
@@ -0,0 +1 @@
+export function canDelete(user: { role: string }) { return user.role === 'admin'; }