---
title: "Authorise every object · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/api-security/object-authorisation
updated: 2026-10-20
licence: "All rights reserved"
---

# Authorise every object

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [API security](https://agentwranglers.se/playbook/api-design/api-security)
- Rule: Check on every request that the caller may access the exact object, not just the endpoint.
- How: Load the object through a query scoped to the caller, so another tenant's ID simply isn't found. The security playbook's [object access rule](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access) has the attack.
- Check: Request another customer's order with your own token. The answer is 404.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/object-authorisation`.

- Previous: [Grant narrow scopes](https://agentwranglers.se/playbook/api-design/api-security/token-scopes)
- Next: [Keep secrets out of addresses](https://agentwranglers.se/playbook/api-design/api-security/no-secrets-in-urls)
- [API security](https://agentwranglers.se/playbook/api-design/api-security)