How to Protect ASP.NET Core APIs Against Broken Function Level Authorization

Broken Function Level Authorization (BFLA) - listed as API5 in the OWASP API Security Top 10 - is one of the most exploited vulnerabilities in production APIs, and it is surprisingly easy to miss in A