List access is not item access

Being allowed to open a collection endpoint does not mean every object in the result is fair game. A common bug: authorize GET /projects with "user can list projects," then return every row the query