An API validates that a caller is logged in but does not check whether that caller owns the requested customer's record. Which control is missing?

1. More frequent backups only
2. A longer session duration
3. A different data compression format
4. Record-level authorization