HarborCart hosts multiple merchants in one reporting platform. Each merchant must see only its own records, even if it modifies browser requests. Where should the authorization boundary be enforced?

1. In trusted service and data-access controls using the authenticated tenant identity.
2. Only by hiding other merchants in the browser navigation.
3. By accepting a merchant identifier supplied by the browser without checking ownership.
4. By granting every merchant a shared project-wide reader identity.