ListRequestHandlerBase<TRow,TListRequest,TListResponse>.ValidatePermissions method
Validates if the user is allowed to query this entity type by checking ReadPermissionAttribute and ServiceLookupPermissionAttribute if the request is in lookup access mode.
protected virtual void ValidatePermissions()
Remarks
This check is per row type, not per record, so it does not prevent listing records that belong to other users or tenants. For record level authorization, implement a behavior that applies the required filter in OnPrepareQuery, or override this method. See the multitenancy tutorial in Serenity docs.