Transactions and functions limited to authorized users

CMMC 2.0 AC.L1-3.1.2 (NIST 800-171r2 3.1.2) requires that users are limited to the specific transactions and functions they are authorized to execute — not merely authenticated to the system. Without ownership or role checks on write operations, any logged-in user can modify or delete records belonging to others, a vulnerability OWASP A01 and CWE-285 classify as Broken Access Control. In FCI-handling systems this creates an audit trail problem: if user A can overwrite user B's contract documents, data integrity and individual accountability both collapse — both mandatory CMMC concerns.

Add an ownership or role check immediately after the session check in every mutation handler. Authentication and authorization are two separate gates — passing the first does not satisfy the second:

// app/api/documents/[id]/route.ts
export async function PUT(req: Request, { params }: { params: { id: string } }) {
  const session = await getServerSession()
  if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 })

  const document = await db.document.findUnique({ where: { id: params.id } })
  if (!document) return Response.json({ error: 'Not found' }, { status: 404 })

  // Ownership check — not just "is there a session?"
  if (document.userId !== session.user.id && session.user.role !== 'admin') {
    return Response.json({ error: 'Forbidden' }, { status: 403 })
  }

  const body = await req.json()
  const updated = await db.document.update({ where: { id: params.id }, data: body })
  return Response.json(updated)
}

Report the ratio of mutation endpoints covered — partial coverage is still a CMMC failure under AC.L1-3.1.2.