SAMPLE EVIDENCE for DX-06 (made-up app Tidyhaus; not a real review)

rpc/cleaner_availability (security invoker): signed out -> 200, public slots only.
rpc/cancel_booking (security definer): as user B with A's booking id -> 400 "not your booking"; A's booking unchanged.