An API returns a document when a caller supplies its identifier, without checking the caller's access to that document. Which control directly addresses the flaw?

1. Add more API replicas
2. Require a longer document identifier as the only defense
3. Encrypt only the API's DNS records
4. Perform object-level authorization on each document request