... offers, while the api will take a request the ui would never send, someone else's id in the params or a field the form doesn't expose. the agent writes the route so the happy path works and stubs the auth check to match. what caught the most for me was hitting my own endpoints with a second account's token and seeing what came back. Comment from Zain Dana Harper(@harperz9): I am building this from the opposite ...