SAMPLE EVIDENCE for PM-03 (made-up app Tidyhaus; not a real review)

Sent as: user C (free test account)
PATCH https://staging.tidyhaus.example/rest/v1/profiles?id=eq.[user C]  body {"plan":"pro"}
Authorization: Bearer [token redacted]

Response: HTTP 403
{"code":"42501","message":"permission denied for column plan"}