Implement only the smallest agreed authorization correction in this local exercise.
Keep the same-tenant owner and finance administrator use cases working. Add a
negative regression case that would fail with the original faulty policy. Run node
--test lab.test.mjs and report the real result, remaining assumptions and diff. Do
not weaken an existing check to make a test pass. In an application, derive identity
and roles from verified server authentication and enforce the policy on every
relevant request. Stop before deployment.
