Logged in answers 'who are you'; allowed answers 'is this record yours'.

Authentication proves identity, but every request that names a record still needs its own question: may this person touch this one? A page that changes only the number in the URL and returns a stranger's data has skipped that step. Hiding buttons, encrypting the connection or throttling requests does nothing to answer it. The check must run on the server, per record.

Read it once, then a question tests whether the trick stuck.