A service returns a customer's records based only on a caller-supplied customer ID. What security check is missing?

1. Only a check that the ID is numeric.
2. Only a rate limit of one request per second.
3. A longer object filename.
4. Authorization that the authenticated caller may access that specific customer's data.