The main idea behind this new category is that even though a specific API can enforce sufficient object-level authorization security measures, it might still not be enough. One such example can be seen in recent