Creating a child resource still needs a check on the parent

When you authorize create:comment, also check that the actor can access the parent (the ticket, document, or thread).

Skipping the parent check is a classic confused-access path: anyone who can guess or enumerate a parent id can attach children under objects they should never see.

Authorize both:

1. permission to create the child type
2. permission to use that specific parent

Same pattern for attachments, replies, and nested folders.