List access is not item access

Being allowed to open a collection endpoint does not mean every object in the result is fair game.

A common bug: authorize GET /projects with "user can list projects," then return every row the query finds without checking which projects the caller owns or belongs to. That list check answered "may they see a list?" — not "may they see this project?"

Authorize at the object boundary:

• Filter the query by what the subject is allowed to see, or
• Check each returned item (or batch-check) before you serialize it

The same pattern applies to search, exports, and embedded "related resources." If the UI only shows rows the user owns but the API also returns neighbors, you have an IDOR waiting to happen.