The club card that upgraded itself

Loaf runs a loyalty scheme called Crumb Club. Members climb tiers — Crumb, Half Loaf, Whole Loaf — by how much they spend over time, and each tier unlocks a bigger discount; the top one adds a free pastry with every order. Members can edit their own profile from an account page: name, email, delivery address, favourite bake. Everything else — tier, discount rate, store credit, whether someone's staff — is set by the loyalty jobs and the back office. Members don't get to touch those. Marina flagged a member during the weekly perks review. Theo Whitmore joined five days ago and has spent £15.70. The roster even prints the tier he's *earned* from that spend: Crumb, the bottom rung. But the tier he's actually holding is Whole Loaf — full 10% discount, a free pastry every order, and £50 of store credit sitting in his account. Nobody in the back office issued any of it. There's no discount button, no "grant credit" control, nothing on the account page that could have done this. The whole storefront was scaffolded by an AI assistant, and it's been running the club without complaint. Edit a profile through the page and it behaves exactly as designed — your four fields change and nothing else moves. So how did an ordinary member end up with the keys to the top tier, and how would you stop the next one from handing themselves the same thing?