- name: order-owner-required
  where: "app/Policies/OrderPolicy.php"
  ensure: >-
    The update policy grants access only when the authenticated user id equals the order user_id. It must not return true for a different user.