diff --git a/tests/edge-security-v1774.mjs b/tests/edge-security-v1774.mjs
index e7ef4f8..08b4f34 100644
--- a/tests/edge-security-v1774.mjs
+++ b/tests/edge-security-v1774.mjs
@@ -6,6 +6,8 @@ check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is remo
 check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
 check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');
 check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated');
+check(src.includes('["admin", "manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles');
+check(!src.includes('"operator"')&&!src.includes('"owner", "admin"'),'invented employee roles are not accepted');
 check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side');
 check(src.includes('employee_create_failed'),'unexpected failures return a safe public code');
 check(!src.includes('return reply({ error: e instanceof Error ? e.message'),'raw exception messages are not returned');