A user can authenticate successfully, but the API must also enforce access to only that user records. Which control belongs in the application authorization path?

1. Hide other users record links in the interface but allow direct API access.
2. Grant all records whenever the JWT signature is valid.
3. Derive trusted identity from validated authentication and enforce resource ownership or tenant permissions server-side.
4. Trust a user_id field supplied by the browser without checking the authenticated identity.