SAMPLE EVIDENCE for AR-03 (made-up app Tidyhaus; not a real review)

Sent as: user B (test account)
PATCH https://staging.tidyhaus.example/rest/v1/profiles?id=eq.[user B]  body {"role":"admin"}
Authorization: Bearer [token redacted]

Response: HTTP 200
[{"id":"[user B]","role":"admin"}]