Object-Level AuthZ (IDOR / BOLA)

Enforce ownership on object IDs so Student A cannot read Student B’s resources (BOLA/IDOR).

This room unlocks when you enrol in a linked course or have a matching Learn plan. No separate lab checkout — practice stays inside the track.