What is BOLA, and why doesn't Spring Security's authentication automatically prevent it?

BOLA (Broken Object Level Authorization) is when an authenticated user accesses another user's specific resource simply by manipulating an identifier in the request (e.g., changing an account ID in the URL). Authentication only confirms WHO you are; it says nothing about whether the specific resource being requested actually belongs to you. Preventing BOLA requires explicit ownership checks in your business logic — e.g., method-level @PreAuthorize expressions or repository queries scoped to the current user — Spring Security provides the tools, but the ownership rule itself is application-specific and must be written deliberately.