diff --git a/apps/api/plane/tests/contract/app/test_project_put_authz.py b/apps/api/plane/tests/contract/app/test_project_put_authz.py
index a1da154068..b018859eec 100644
--- a/apps/api/plane/tests/contract/app/test_project_put_authz.py
+++ b/apps/api/plane/tests/contract/app/test_project_put_authz.py
@@ -2,7 +2,10 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # See the LICENSE file for details.
 
-"""Contract tests for ``ProjectViewSet`` PUT authorization (SECUR-248).
+"""Contract tests for ``ProjectViewSet`` PUT authorization.
+
+PUT must enforce the same authorization as PATCH, not fall through to DRF's
+generic handler under the bare default permission class.
 
 ``urls/project.py`` maps ``"put": "update"``, but the viewset never defined
 ``update`` — so PUT fell through to DRF's ``ModelViewSet.update``. The class sets