- name: action-write-authorization
  where: "app/orders/actions.ts"
  ensure: >-
    cancelOrder must obtain a verified actor and constrain updateMany by that actor tenantId and ownerId before mutating the order.