A route-level check like "any authenticated user may GET /documents/:id" is not authorization. It only proves the caller can hit the endpoint.
Authorization asks: may this caller act on this document? Resolve the object, then evaluate a policy against the subject, action, and resource (and tenant if you have one). Skipping the object check is how IDOR happens — guessing or iterating IDs past a coarse gate.
Pattern: load the resource by ID from a trusted store, then allow or deny with an explicit decision. Never infer access from "they knew the URL."
