A new note was added to API1:2023 (Broken Object Level Authorization) clarifying that GUIDs/UUIDs are not an authorization control (see #155 / #154). It was added to `editions/2023/fa/0xa1-broken-object-level-authorization.md` in English as a placeholder so it wouldn't be missed. This issue tracks translating that note into Persian (Farsi) to match the rest of the document. The note currently reads: > **Note** > > * Using GUIDs/UUIDs instead of predictable identifiers helps mitigate object enumeration attacks. However, once a valid identifier is disclosed—whether through another endpoint, excessive data exposure, logging, or another vulnerability—it should be treated as public information. > > * Authorization decisions must never rely on the secrecy or unpredictability of object identifiers. Every request must independently verify that the authenticated user is authorized to access the requested object.