The first authorization bug I ever shipped wasn't a missing [Authorize] attribute. It was the opposite — everything had [Authorize] , the tests were green, and it still let one user edit another user's stuff. The attribute was doing exactly what it promised. I just wanted it to promise something else. That's the gap that trips people up: [Authorize] answers "is this user allowed to hit this endpoint." It has no idea "is this user allowed to touch this specific row." Those are two differe...