Access control rules not enforced consistently

Some users can access resources they should not have permission to view. This suggests inconsistencies in authorization checks across different API endpoints.