Batch APIs still need per-item authorization

A batch endpoint that checks permission once for the whole request is a common leak.

Example: DELETE /items with body { "ids": [1, 2, 3] }.
If you only verify "user can delete items" (or only check the first id), items 2 and 3 may get deleted even when the caller has no rights on them.

Authorize each resource in the batch. Collect allow/deny per id. Prefer a partial-success response (or fail the whole batch only when that is an explicit product rule) — never assume one check covers every id.

Same idea applies to bulk updates, exports, and "select all" admin actions.