diff --git a/internal/httpapi/auth.go b/internal/httpapi/auth.go
index b6d3d3c..5c0d653 100644
--- a/internal/httpapi/auth.go
+++ b/internal/httpapi/auth.go
@@ -41,10 +41,19 @@ func authMiddleware(devAuth bool, adminGroups []string) func(http.Handler) http.
 			if devAuth {
 				u = devUser
 				// Local dev runs as a super-admin so every screen is reachable.
-				// Append ?as=user to any request to simulate a non-admin member.
-				u.IsSuperAdmin = r.URL.Query().Get("as") != "user"
-				if !u.IsSuperAdmin {
+				//   ?as=user            → 고정 데모 구성원(비관리자)
+				//   ?as=<email>         → 그 이메일의 구성원으로 가장(로컬 멀티유저 테스트용;
+				//                         관리자 여부는 그 Member.Role로 결정)
+				as := strings.TrimSpace(r.URL.Query().Get("as"))
+				switch {
+				case as == "":
+					u.IsSuperAdmin = true
+				case as == "user":
 					u = User{ID: "u-member", Name: "김주임", Email: "member@special-partners.com", Role: "주임", Groups: []string{"user"}}
+				case strings.Contains(as, "@"):
+					u = User{ID: "u-" + as, Name: as, Email: as, Groups: []string{"user"}}
+				default:
+					u.IsSuperAdmin = true
 				}
 			} else {
 				var ok bool