Memory aid
Don't trust the ID in the URL. Always re-check ownership server-side.
⚠ Most common mistake
Treating front-end filtering as authorization.
Go deeper
Need more than a one-liner? Pick a view — first time generates with AI, after that it’s instant for everyone.