SAMPLE EVIDENCE for AR-01 (made-up app Tidyhaus; not a real review)

Sent as: user B (test account)
GET https://staging.tidyhaus.example/rest/v1/bookings?id=eq.8812&select=*
Authorization: Bearer [token redacted]

Response: HTTP 200
[]  (no rows: B cannot read A's booking)

PATCH /rest/v1/bookings?id=eq.8812 {"notes":"changed by B"}
Response: HTTP 200, [] (0 rows changed)