Access check runs after the write

An access check only works if it can prevent the operation it is meant to protect. If it sits after the write call, the row is already in the database by the time the check runs — the abort then prevents at most the response, not the change.

The case typically arises after the fact: the function was open at first, an auth check was added later, and it landed wherever there was room — often right before the `return`, because that is where error handling lives. In review it reads as plausible, because the check is visibly there.

Check it yourself: in every function that writes, the first substantive step must be the identity check with an immediate bail-out. Nothing above it may modify data.