Broken object-level authorization is the most common serious flaw in multi-tenant products and the hardest to catch, because every exploiting request is well-formed, authenticated, and returns a clean 200. No scanner finds it. The only reliable method is to enumerate the cross product of actors, objects and actions and compare what the system does against what policy says — which is what this runs, against a clinical platform where the objects are PHI.