Every time an API receives an object ID from a client, it must verify that the requesting user is authorized to access that specific object. Every time. Every endpoint. No exceptions.
Scale. A large API can have hundreds of endpoints. Every single one that accepts an ID needs this check. Miss one and that endpoint is exposed.
Assumption. Many developers assume "if they have the ID, they're allowed." IDs are treated as secrets — but they're not. Sequential integers are trivially guessable.
Testing gaps. Standard unit tests don't catch BOLA because they test your data with your credentials. BOLA only appears when you test someone else's data with your credentials.
The next 7 slides cover each prevention strategy. They layer on top of each other — no single one is enough on its own. Real security comes from applying several together.