Modeling Permission

Three shapes, and most applications need two of them.

Ownership. Is this yours? Depends on the specific record, so it cannot be answered by a role.

Role. Are you staff, an editor, an admin? Answered once per person, not per record.

Relationship. Are you a member of the team this belongs to? The common one people model badly, usually by adding a role that means 'member of team 7'.

Answer ownership in the query. Fetching with the owner as part of the lookup means the wrong record cannot be retrieved at all. There is no separate check to forget, and a missing record fails as a 404 rather than a 403, which also avoids confirming that somebody else's record exists.

Answer roles with the permission system your framework already has. Answer relationships with a real table, because that is what they are.