# Add the missing authorization check

Endpoints an audit listed as missing an ownership check, fixed with a test per endpoint proving the wrong actor is refused.

Category: Security patching
Source: https://letsship.ai/use-cases/add-the-missing-authorization-check
Published: 2026-08-25

## Goal

Add the missing authorization check to the endpoints an audit listed, and prove the wrong actor is refused.

## Acceptance criteria

- Each listed endpoint checks the actor against the resource
- A test per endpoint asserts a refusal for an actor who should not have access
- A test asserts the legitimate actor is unaffected
- Refusals use the existing error shape, not a new one

## What lands as proof

Two tests per endpoint, one proving the refusal and one proving the legitimate caller still gets through.

## Prompt

Copy this to an agent to open the ticket:

```text
Create a Linear issue in my team and assign it to the SHIP agent.

Title: Add the ownership check to {endpoint}

Description: An endpoint authenticates the caller but never checks whether they own the resource they are asking for.

Acceptance criteria:
- The endpoint checks the actor against the resource
- A test asserts a refusal for an actor who should not have access
- A test asserts the legitimate actor is unaffected
- The refusal uses the existing error shape, not a new one

Before you create the issue, find an endpoint in this repository that reads a resource by id without checking ownership, and replace {endpoint} with it. Name the resource and the ownership rule in the description.
```

## Questions

### What does the agent actually change?

The ticket is scoped to one outcome: add the missing authorization check to the endpoints an audit listed, and prove the wrong actor is refused. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.

### How do I know the work is done?

The pull request carries the evidence, not only the diff. Here that means one test per endpoint proving the wrong actor is refused, so a reviewer can confirm the result without reproducing the work locally.

### How much oversight does this need?

The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.