Getting API Security Right - Philippe De Ryck - NDC Security 2022

what if you have endpoint user/tasks/{id} and you dont put validation if you have access to this task but when you make call to the db you use the filter task = id and userid = token.userid ?

Now that is a really really good talk.
Thanks a lot Philippe De Ryck