diff --git a/tests/integration/ai-settings.test.ts b/tests/integration/ai-settings.test.ts
new file mode 100644
index 0000000..e574df0
--- /dev/null
+++ b/tests/integration/ai-settings.test.ts
@@ -0,0 +1,48 @@
+import { describe, it, expect, beforeAll } from "vitest";
+import PocketBase from "pocketbase";
+
+import { APP_URL, DEMO, adminPb, requireServices, signIn, userPb } from "./helpers";
+
+let admin: PocketBase;
+
+beforeAll(async () => {
+  await requireServices();
+  admin = await adminPb();
+});
+
+describe("the AI key never leaves the server", () => {
+  it("is not readable by a client manager", async () => {
+    const pb = await userPb(DEMO.managerEmail, DEMO.managerPassword);
+    // Every rule on `settings` is null — superuser only.
+    await expect(pb.collection("settings").getFullList()).rejects.toThrow();
+  });
+
+  it("does not appear in the settings page HTML", async () => {
+    const marker = `sk-test-should-not-leak-${Date.now()}`;
+
+    const existing = await admin
+      .collection("settings")
+      .getFirstListItem("id != ''")
+      .catch(() => null);
+    const record = existing
+      ? await admin.collection("settings").update(existing.id, { ai_api_key: marker })
+      : await admin.collection("settings").create({ ai_api_key: marker });
+
+    const cookie = await signIn(DEMO.ownerEmail, DEMO.ownerPassword);
+    const response = await fetch(`${APP_URL}/admin/settings`, { headers: { cookie } });
+    const html = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(html).not.toContain(marker);
+
+    await admin.collection("settings").update(record.id, { ai_api_key: "" });
+  });
+});
+
+describe("the admin settings page is owner-only", () => {
+  it("returns 404 for a client manager", async () => {
+    const cookie = await signIn(DEMO.managerEmail, DEMO.managerPassword);
+    const response = await fetch(`${APP_URL}/admin/settings`, { headers: { cookie } });
+    expect(response.status).toBe(404);
+  });
+});
\ No newline at end of file
diff --git a/tests/integration/helpers.ts b/tests/integration/helpers.ts
index 292b3d0..283bb10 100644
--- a/tests/integration/helpers.ts
+++ b/tests/integration/helpers.ts
@@ -8,6 +8,8 @@ export const DEMO = {
   projectSlug: "wfdash-webapp",
   managerEmail: "manager@wf.example.com",
   managerPassword: "manager-password-123",
+  ownerEmail: "owner@example.com",
+  ownerPassword: "owner-password-123",
 };
 
 /**