Fix BOLA on Record Endpoints

A record endpoint needs two facts before it returns data: who the caller is and whether that caller may act on this record. A valid ID proves neither. OWASP API Security Top 10 calls this Broken Object Level Authorization when an API does not enforce access on the specific object.

Review the handler path

Trace a synthetic request from authentication to the database and response. Write down where the record is loaded, where its tenant or owner is read, and where the permission decision happens. The check must run before sensitive fields are serialized or side effects are scheduled.

Prefer a query or policy that binds the requested object to the trusted tenant context. A separate check can also work when it is applied consistently and cannot race with a later mutation. Do not rely on an object ID being hard to guess. Do not assume a list route protects the detail route.

Prove the fix

Create two synthetic tenants, each with one record. Test a permitted read, a denied cross-tenant read, a revoked member, and an anonymous caller. Check the response body as well as the status. For mutations, also check that denied requests leave storage and queued work unchanged. Run the cases through alternate routes that reach the same record, including API versions and nested endpoints.

The OWASP Authorization Cheat Sheet supports checks on each resource and action. A passing test proves this path in the tested build. It does not prove all record types are covered. Add the route and its test owner to the permission inventory. If the business rule is unclear, hold the endpoint change until the owner states who may do what.