diff --git a/.changeset/9350-auth-permissions-useauth-guard-both.md b/.changeset/9350-auth-permissions-useauth-guard-both.md
new file mode 100644
index 0000000000..35706b0581
--- /dev/null
+++ b/.changeset/9350-auth-permissions-useauth-guard-both.md
@@ -0,0 +1,7 @@
+---
+---
+
+Guard both `isAuthenticated` and `user` in the `useAuth` example of
+`skills/objectui/guides/auth-permissions.md`, and say why beside it
+(objectui#9350). Published skills guidance only; no package is released by
+this change.
diff --git a/skills/objectui/guides/auth-permissions.md b/skills/objectui/guides/auth-permissions.md
index 0ca663ed8f..dd4e463306 100644
--- a/skills/objectui/guides/auth-permissions.md
+++ b/skills/objectui/guides/auth-permissions.md
@@ -35,6 +35,8 @@ function App() {
 
 ### useAuth hook
 
+Guard `user` on its own, not through `isAuthenticated`: in guest mode (`enabled: false`) and in preview mode, `AuthProvider` hardcodes `isAuthenticated` to `true` while `user` stays `null`, so a signed-in-looking context can still carry no user. The shipped `UserMenu` guards both members the same way.
+
 ```typescript
 import { useAuth } from '@object-ui/auth';
 
@@ -42,7 +44,7 @@ function UserBadge() {
   const { user, isAuthenticated, isLoading, error, signOut } = useAuth();
 
   if (isLoading) return <Spinner />;
-  if (!isAuthenticated) return <LoginButton />;
+  if (!isAuthenticated || !user) return <LoginButton />;
 
   return (
     <div>