Three checks run in order: authenticate the session or token, function-level and object-level authorization, then the allowlist schema. An ownership check stops aero-labs from reading another tenant's GET /api/v2/telemetry/pass-8841 (Broken Object Level Authorization / IDOR, OWASP API1).