Separate intended permissions from observed API responses with a hypothetical two-user matrix. UUIDs and successful requests are not authorization evidence.