Review permission checks in an endpoint

Inputs: [ENDPOINT CODE], [ROLE RULES], [REQUEST EXAMPLES]. Trace validation, authentication, authorisation and data access in order. Build denial tests for each role and resource-owner case. Output: A control-flow table and suggested tests; do not deploy changes. Check: Identify any path that could reach sensitive data, including error responses, and mark unexecuted tests as proposed rather than passed. If essential information is missing, identify it rather than guessing.