A client changes a request's organization ID to access another organization's learner records. What must the backend enforce?

1. Authorization for the requested organization's data using trusted caller context
2. Permit the request whenever the identifier is numerically valid
3. Trust any organization ID that appears in a URL
4. Rely only on hiding the organization selector in the browser