A managed session store groups records with actor_id. The frontend lets clients submit arbitrary actor IDs. What must the application do?

1. Derive identity from trusted authentication and enforce per-user access in the application.
2. Accept whichever actor ID the model generates with highest confidence.
3. Assume actor_id automatically prevents all cross-user access for any caller.
4. Make all sessions public to avoid mismatched identifiers.