diff --git a/shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py b/shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py
index 7962e42..5489342 100644
--- a/shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py
+++ b/shierfeng-fastapi-backend/tests/module_business/test_api_permission_contract.py
@@ -24,17 +24,8 @@ CONTROLLER_NAMES = (
     'report',
 )
 TARGET_PREFIXES = (
-    '/master/strain',
-    '/master/customer',
-    '/master/site',
-    '/master/line',
-    '/master/warehouse',
-    '/master/pallet',
-    '/business/inbound',
-    '/business/filling',
-    '/business/shipment',
-    '/business/usage',
-    '/business/return',
+    '/master',
+    '/business',
     '/report',
 )
 ROUTE_HTTP_METHODS = frozenset({'DELETE', 'GET', 'HEAD', 'OPTIONS', 'PATCH', 'POST', 'PUT', 'TRACE'})
@@ -187,6 +178,14 @@ class ApiPermissionContractTest(unittest.TestCase):
             route for route in cls.app.routes if isinstance(route, APIRoute) and _is_target_path(route.path)
         ]
 
+    def test_target_path_selector_uses_namespace_boundaries(self) -> None:
+        for path in ('/master', '/master/foo', '/business', '/business/foo', '/report/foo'):
+            with self.subTest(path=path):
+                self.assertTrue(_is_target_path(path))
+        for path in ('/masterish', '/business-other', '/reporting'):
+            with self.subTest(path=path):
+                self.assertFalse(_is_target_path(path))
+
     def test_openapi_has_exact_target_operations_and_no_ai_routes(self) -> None:
         actual_operations = {
             (path, method.upper())
@@ -228,8 +227,11 @@ class ApiPermissionContractTest(unittest.TestCase):
     def test_controller_ast_has_exact_literal_permission_set(self) -> None:
         literals: list[str] = []
         malformed_calls: list[str] = []
-        for controller_name in CONTROLLER_NAMES:
-            source_path = BACKEND_ROOT / 'module_business/controller' / f'{controller_name}_controller.py'
+        controller_paths = sorted((BACKEND_ROOT / 'module_business/controller').glob('*_controller.py'))
+        actual_controller_names = {source_path.stem.removesuffix('_controller') for source_path in controller_paths}
+        self.assertEqual(set(CONTROLLER_NAMES), actual_controller_names)
+
+        for source_path in controller_paths:
             tree = ast.parse(source_path.read_text(encoding='utf-8'), filename=str(source_path))
             for node in ast.walk(tree):
                 if not (