Authorisation and scopes

Knowing who they are is not knowing what they may do

Authentication establishes identity; authorisation decides permission. Conflating them produces the most common serious API bug: any authenticated user can read any record by changing an id in the URL.

Check ownership at the point of data access, not in the route. A helper that fetches a resource scoped to the current user makes the safe path the default one.

Roles are coarse and simple; scopes are finer and better for third-party clients. Either works — an inconsistent mix of both does not.