Every API endpoint that accepts an object ID must verify two things: (1) the user is authenticated (valid token/session) and (2) the user is authorized to access that specific object (they own it or have explicit permission).
The check must happen in the server-side code for every request. Not just at login. Not just sometimes. Every single time an ID comes in from a client.
When user 1042 requests order 1041 — the server should ask: "Does user 1042 own order 1041?" If the answer is no, return a 404 (not 403 — don't confirm the record exists). Denied.
This only works if developers apply it consistently to every endpoint. One missed endpoint is all an attacker needs. You still need testing (MIT 04) to verify coverage.
When denying access to an object a user doesn't own, return 404 Not Found instead of 403 Forbidden. A 403 confirms the record exists — which tells an attacker they found a valid ID. A 404 reveals nothing.
Ask your team: when a user requests a record, does the system verify that they own it — or just that it exists? Those are two different checks, and only one of them prevents BOLA.