A batch request must authorize every item

When you accept an array of IDs in one request — for example DELETE /items with { "ids": [...] } it is tempting to authorize once, then loop. That is how object-level bugs sneak in. Authorize each it