IDOR
Also called insecure direct object reference, BOLA
The kind of broken access control you can do with a keyboard. /invoices/1003 is yours, so you try /invoices/1004 and get a stranger's, because the server looks up the id and never asks whose it is.
A test that a user can read their own invoice passes with or without the check. You need a test with two users, and an agent doesn't write that unless asked.
Say it to your agent
“Look the invoice up through the signed-in user, with WHERE id = ? AND owner_id = ?, and return 404 if it isn't theirs. Add a test where user B requests user A's invoice and gets 404.”