Authorization must often consider the resource being accessed.

For example, GET /projects/42 should not simply verify that the user has project:read. It should also verify that project 42 belongs to an organization the user can access.

A common security vulnerability is an IDOR/BOLA problem: a user changes /users/42 to /users/43 and gains access to another user's resource because the API checks authentication but not ownership.