---
title: "Check ownership on every record · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access
updated: 2026-10-20
licence: "All rights reserved"
---

# Check ownership on every record

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)
- Rule: Before returning or changing a record, check on the server that it belongs to the logged-in user or their team.
- How: Look records up with the user in the query, such as `WHERE id = $1 AND owner_id = $2`. Answer 404 for records the user may not see, so they learn nothing. Random IDs make guessing harder, but they are no defence alone. For APIs, see [object authorisation](https://agentwranglers.se/playbook/api-design/api-security/object-authorisation).
- Check: Log in as two test users. With user A's token, request, change and delete user B's records by ID. Try list, export and search routes, IDs inside request bodies and GraphQL queries too. Every request returns 404 or 403, and lists show only A's records.

Example:

```http
GET /api/invoices/2002 HTTP/1.1
Authorization: Bearer <token of user A, who owns invoice 2001>

HTTP/1.1 404 Not Found
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access`.

- Next: [Check roles on every action](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access)
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts)