Securing the Booking API

Five callers use the booking service, and each one needs a different answer from it:

• An anonymous visitor browsing the concerts at Riverside Hall.
• Ana, a customer who books seat A12 for event 7.
• Ben, another customer, who must never see or cancel Ana's booking.
• staff@riverside.example, who creates events.
• admin@riverside.example, from the venue's support desk, who helps customers with their bookings.

The earlier lessons added the pieces one at a time: a filter chain, tokens, a browser sign-in, method rules, and browser protections