The record API /m02-p/naked/method-tamper/api/records/<id> authorizes GET correctly (only the owner may read: record 3002 is not yours, so a GET returns 403). But the destructive verb on the same object skips that check. Try DELETE on a record that is not yours.