Your GET /docs/:id has a permission check. Does GET /docs?

Most apps I've looked at guard single-object routes fine. You fetch the document, check the user can read it, return 403 or 404 if not. The list endpoint is where things slip.

A common version: the list query filters by tenant_id and nothing else. Inside one tenant, everybody sees every row, including private drafts, HR folders, or a project they were removed from last week. Another version: the list does filter, but search, export, autocomplete, and the "recent items" widget each run their own query, and only one of them got the filter.

A few things that have worked for me:

1. Put the permission filter in one function that returns a query, and make every list-shaped endpoint call it. Search, export, and counts included.
2. Don't load everything and then drop rows in application code. Pagination breaks (page 1 comes back with 3 items out of 20), and totals leak how many hidden rows exist.
3. Write one test per list endpoint with two users in the same tenant who should see different things. Assert on the IDs returned, and on the total count.
4. Watch the count badges. "You have 14 documents" next to a list of 9 tells people something.

For simple role checks, a WHERE clause is enough. Once sharing and nested folders come in ("can see it because they can see the parent folder"), the filter gets harder to express in SQL, and that's usually when teams start thinking about a separate authorization layer that can answer "which IDs can this user see?" as well as yes/no questions.

How do you handle list filtering when permissions are inherited through folders or teams?