Address API3:2023 Broken Object Property Level Authorization (BOPLA) per OWASP API Security Top 10 2023. BOPLA combines previous API3 Excessive Data Exposure and API6 Mass Assignment categories. BOPLA occurs when an API exposes more properties than the authenticated user is entitled to read or allows the user to modify properties they should not be able to modify. Mitigations include (a) implement explicit object-to-output schema mapping with allowlist of fields per role + use case, (b) avoid generic serialisation that exposes all object properties, (c) validate input + reject unexpected properties + use explicit input schema, (d) implement property-level access control where appropriate, (e) test for over-disclosure + over-permissive update patterns.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.