Rubric: 10 points

Area	Points	Evidence
Observe the starter	2	Correctly identifies Alex's identity and explains why reading Sam's record violates the rule.
Repair authorization	3	Server function compares record owner with user ID; no blanket denial or hard-coded record-ID workaround.
Verify behavior	3	Shows own access, other-user denial without record leakage, invalid/missing handling and honest check output.
Explain the boundary	2	Distinguishes ID/permission and browser controls/server enforcement; recognizes supplied authentication.

Guided repair can earn full marks. Do not deduct for using the supplied scaffold. Optional discussion is not required. Where setup prevents execution, mark verification as unperformed and assess reasoning separately; do not award execution evidence for a proposal alone. Accept equivalent boolean ownership checks with correct behavior.