Killing IDORs in Rails Applications: Make the Database Say "No" By Default

Rails is great at making the happy path simple. You need a record, you write Model.find(params[:id]). You need an authorization check, you add a line under it. The code reads well, it feels clean, it passes review, and it's also the reason why perfectly competent teams ship IDORs (Insecure Direct Object Reference). The issue is not that people don't know they need authorization. The issue is that "fetch then check" relies on humans to remember the check every time, across every new endpoint, refactor, export job, and admin screen. One missing line is enough. If you want to kill IDORs in a Rails app, you don't start by writing more checks. You start by changing the shape of your code so the insecure version becomes harder to write.