BOLA / IDOR
An object identifier is a reason to review authorization, not proof of BOLA.
Broken Object Level Authorization occurs when a caller can access or modify an object it should not be allowed to reach. OpenAPI can identify object-addressing operations, but only runtime behavior can prove the authorization failure.
Object-addressing operations create an authorization question.
Routes such as GET /users/{id}, PATCH /orders/{order_id}, or DELETE /documents/{document_id} tell you a caller can select a resource. The identifier itself is not a vulnerability.
Use the contract to build the object-authorization test plan.
Find object selectors
Identify path and operation parameters, including reusable and inherited parameters.
Find sensitive operations
Prioritize write, delete, privileged, financial, or sensitive-data endpoints.
Review declared identity
Check whether authentication is mandatory and what authorization metadata is declared.
BOLA confirmation requires more than the contract.
Meaningful dynamic verification compares identities or resource ownership contexts and requires authorized identities, safe target data, and controls against destructive behavior.
An object-access finding is a signal to verify object-level authorization, not an exploit claim.
Agent tools make object boundaries even more important.
Prompt instructions or tool descriptions are not an authorization boundary. Object-level authorization still belongs server-side.