Backend & systems·Security and identity
you check whether this particular user is allowed to touch this particular record, not merely that they are logged in.
Authorization
Also calledauthz, access control, permissions
Deciding whether an authenticated principal may perform an action on a resource. The dangerous gap is object-level: the endpoint checks the role but not that the record belongs to the caller, so changing an id in the URL returns someone else's data. It must be enforced server-side per request, on every path that reaches the resource.