SAMPLE EVIDENCE for DX-02 (made-up app Tidyhaus; not a real review)

booking_summary has security_invoker = true.
Signed out: GET /rest/v1/booking_summary -> HTTP 200, []
As user B: returns only B's 3 bookings.