Reviews API routes, controllers, GraphQL resolvers and server actions before you merge: can a signed-in user read, change or delete another user's or another tenant's data by changing an id, and can they do what their role does not allow. Catches objects loaded by id with no owner or tenant check, tenants taken from headers, nested and batch routes checked on the wrong object, unscoped lists and exports, admin routes open to any account, mass assignment of role or owner fields and responses that return every column, then gives the smallest code that closes each path and the two-user tests to run.