"...Changing that ID in a request to your API could fetch data that you’re not supposed to have access to...." By definition, the data that "you" are not supposed to have access to should be in a different table. Every time a business object goes through a process step, it becomes a different type, with a different set of permissions.