An internet-facing API validates JWTs but does not check whether callers own the requested records. What remains vulnerable?

1. Nothing, because any valid token authorizes all records.
2. Only the storage encryption algorithm.
3. Only the subnet's address capacity.
4. Object-level authorization can allow cross-customer data access.