- name: resource-authorization-before-save
  where: "Controllers/OrdersController.cs"
  ensure: >-
    If resource authorization fails, Cancel must return Forbid before changing the order or calling SaveChangesAsync.

- name: stale-update-is-not-success
  where: "Services/CancelOrder.cs"
  ensure: >-
    Apply must return false when SaveChangesAsync throws DbUpdateConcurrencyException. A stale write must not be reported as successful.