access control should be handled by the application and database layers

Always include current authenticated username as part of the query.

Never rely on presentation layer to restrict values submitted by the user

All the above