{
  "context": "Tests whether the agent prevents IDOR by scoping document lookups to the authenticated user's organization, returns appropriate generic error responses, uses non-enumerable IDs, and adds security-relevant comments.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Ownership-verified document access",
      "description": "The document lookup verifies the authenticated user's org_id owns the document — either via an org-scoped query (e.g. get_document_for_org(doc_id, org_id)) or by fetching then explicitly checking ownership before returning. A bare db_get_document(doc_id) returned without ownership verification fails this criterion.",
      "max_score": 10
    },
    {
      "name": "Security comments",
      "description": "The code includes at least one inline comment explaining the authorization rationale (e.g. why the ownership check is necessary, or what vulnerability is being prevented)",
      "max_score": 25
    },
    {
      "name": "UUID/non-enumerable IDs noted",
      "description": "Either the code, comments, or security_notes.md mentions using non-enumerable identifiers (UUIDs or random IDs) as a defense-in-depth measure",
      "max_score": 35
    },
    {
      "name": "No resource existence leak",
      "description": "The implementation does NOT distinguish between 'document not found' and 'document found but forbidden' in its HTTP response — both cases return the same generic status code to the caller",
      "max_score": 30
    }
  ]
}