A client-supplied resource ID is not a permission

When an API takes a path like /documents/123, that ID is a locator, not proof the caller may open the document. Authenticate the subject, then authorize against that specific object (and tenant) befor