- name: resource-authorization-before-save
  where: "Controllers/OrdersController.cs"
  ensure: >-
    If resource authorization fails, Cancel must return Forbid before changing the order or calling SaveChangesAsync.