Address API1:2023 Broken Object Level Authorization (BOLA) + API5:2023 Broken Function Level Authorization (BFLA) per OWASP API Security Top 10 2023. BOLA occurs when an API endpoint exposes endpoints handling object identifiers without verifying that the user is authorised to access the specified object. BFLA occurs when authorisation checks for function-level access are missing or improperly implemented (e.g. allowing role escalation via different HTTP methods or endpoint paths). Mitigations include (a) implement authorisation at every API endpoint that retrieves data by ID, (b) enforce role-based access control (RBAC) and attribute-based access control (ABAC), (c) use unpredictable UUIDs over sequential IDs where appropriate, (d) test thoroughly across user roles + tenancy boundaries + with negative testing, (e) implement consistent enforcement at gateway + service layers + (f) integrate with broader IAM + zero trust progression.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.