// GLOSSARY

BOLA / BFLA

Two core authorization flaws in API security. BOLA (Broken Object Level Authorization) is a horizontal authority violation: accessing another same-level user's object. BFLA (Broken Function Level Authorization) is a vertical authority violation: invoking an administrative function that should be unreachable. Both sit at the top of the OWASP API Security Top 10 (API1 and API5), and their root cause is shared: an authenticated request is assumed to be authorized. Yet authentication knows the identity, while authorization asks whether that identity has a right over this very object or function; at the API layer this second check, though it must be performed at every object access, is often skipped. In multi-tenant architectures the most expensive form of BOLA is the collapse of the customer boundary, and these findings surface not through an automated scanner but through manual validation that follows the business logic.