1 piece
A platform that serves public market information and private executable quotes from one state core has to check its boundary against the object being requested, not against the screen that requested it. Per-screen checks pass while an edited identifier in a request reaches another counterparty's private price. Broken object level authorisation sits consistently near the top of published web application risk lists because it is invisible to every test that only drives the user interface.