--- title: "Check ownership on every record ยท Agent Wranglers" url: https://agentwranglers.se/playbook/accounts/roles-and-permissions/object-access id: ACC-77 level: Required applies: accounts risk: data updated: 2026-10-27 build: a2a6bdfed830 tokens: 1282 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Check ownership on every record For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: ACC-77 - Level: Required - Chapter: [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions.md) - Rule: Before returning or changing a record, check on the server that it belongs to the logged-in user or their team. - Check: Log in as two test users. With user A's token, request, change and delete user B's records by ID. Try list, export and search routes, IDs inside request bodies and GraphQL queries too. Every request returns 404 or 403, and lists show only A's records. - Risk: Data leaked or lost - Applies when: The project has user accounts. - How: Look records up with the user in the query, such as `WHERE id = $1 AND owner_id = $2`. Answer 404 for records the user may not see, so they learn nothing. Put the check in the data access layer, so a new route cannot forget it. Random IDs make guessing harder, but they are no defence alone. For APIs, see [object authorisation](https://agentwranglers.se/playbook/api-design/api-security/object-authorisation.md). ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### HTTP example ```http GET /api/invoices/2002 HTTP/1.1 Authorization: Bearer HTTP/1.1 404 Not Found ``` ## Sources - [OWASP API1:2023 Broken Object Level Authorization](https://api-security.owasp.org/editions/2023/en/0xa1-broken-object-level-authorization/) - [OWASP IDOR Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html) ## Related rules - API-40 [Authorise every object](https://agentwranglers.se/playbook/api-design/api-security/object-authorisation.md) in API design - API-96 [Limit the depth and cost of every GraphQL query](https://agentwranglers.se/playbook/api-design/graphql-and-grpc/graphql-cost-limits.md) in API design - DAT-7 [Keep each customer's data apart](https://agentwranglers.se/playbook/data/multi-tenancy/tenant-isolation.md) in Data and databases - DAT-83 [Turn on row-level security for every table](https://agentwranglers.se/playbook/data/multi-tenancy/row-level-security.md) in Data and databases - ACC-35 [Start with roles and add record rules only when needed](https://agentwranglers.se/playbook/accounts/roles-and-permissions/rbac-then-abac.md) in Accounts and identity - ACC-36 [Test every role and a signed-out visitor against every action](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permission-matrix-test.md) in Accounts and identity - NTF-36 [Check the recipient may still see the item when you send](https://agentwranglers.se/playbook/notifications/channels-and-preferences/recheck-access-at-send.md) in Notifications - NTF-31 [Store every notification in a server-side inbox](https://agentwranglers.se/playbook/notifications/in-app-notifications/notification-inbox.md) in Notifications - AGT-12 [Check the caller's rights on every handle](https://agentwranglers.se/playbook/agents-as-users/mcp-servers/check-handle-owner.md) in Agents as users - TKO-7 [Fix in risk order](https://agentwranglers.se/playbook/codebase-takeover/triage/fix-in-risk-order.md) in Codebase takeover - ECM-42 [Let each seller reach only their own orders and customers](https://agentwranglers.se/playbook/ecommerce/marketplace-sellers/seller-scoped-access.md) in E-commerce and fulfilment - SRH-10 [Filter search results by access inside the query](https://agentwranglers.se/playbook/search/access-and-limits/search-access-filter.md) in Search - TDD-11 [Test the access rules on the running product](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/test-access-rules.md) in Technical due diligence - APS-101 [Decide access in one policy module](https://agentwranglers.se/playbook/application-security/access-control/policy-decision-point.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers accounts and identity playbook`. In code you write, add a comment next to it with the same link. - Previous: [Check a named permission on the server for every action](https://agentwranglers.se/playbook/accounts/roles-and-permissions/permissions-not-roles.md) - Next: [Start with roles and add record rules only when needed](https://agentwranglers.se/playbook/accounts/roles-and-permissions/rbac-then-abac.md) - [Roles and permissions](https://agentwranglers.se/playbook/accounts/roles-and-permissions.md)