A course assignment doesn't settle every action
The discussion tools let instructors moderate courses they're assigned to. But the same person can also participate as a learner, so the server has another question to answer: is this an instructor managing someone else's discussion, or a learner acting on their own thread?
Reply and status actions already made that distinction. Thread and reply deletion did not. Both delete paths now reuse the existing self-moderation guard after resolving the instructor's thread or reply, before calling the service that changes it.
Keep the record lookup inside the permitted course
The action guard sits after the relationship check, not in place of it. Learner requests resolve an enabled enrollment, then a chapter inside the course and a lesson inside both. Instructor queries use primary or assigned course membership; reordering also resolves each item within its selected parent.
One regression sends a valid lesson ID from a different course alongside an allowed course and chapter. It expects 404. The lesson exists, but it isn't part of the relationship that request is allowed to use.
Check the refusal and the record
The delete regressions expect 422 and confirm that the thread or reply remains undeleted. That second assertion matters: an error response alone wouldn't establish that the delete never happened.
The May development record shows 200 responses before the repair and passing focused checks afterward. This confirms the recorded defect and repair path, not coverage of every authorization route.