A client-supplied resource ID is not a permission
A
Practical lessons on auth, authorization, and access control.
When an API takes a path like /documents/123, that ID is a locator, not proof the caller may open the document.
Authenticate the subject, then authorize against that specific object (and tenant) before you load or mutate it. Skipping the object-level check is how IDOR bugs ship: the route works, the ID is guessed or leaked, and another tenant’s data comes back.
Rule of thumb: every resource identifier from the client is untrusted input until an authorization decision says otherwise.