Draw the data path
Sketch where a request enters, which services handle it, and where data is stored. On each connection, mark the identity the service trusts and the data it can change. Prioritize paths that can expose private records, alter shared state, or affect a release.
Link findings to a repeatable check
Write down a misuse case, its likely consequence, and a safe way to reproduce it with test accounts. Pair the mitigation with an owner and review date so the team can revisit it when roles, integrations, or deployment paths change.