01 · Before and afterThe pattern
// before: guard infers action from req.method → POST means "create"
router.post('/export/:resource', guard(), handler);
// after: the route says what it does
router.post('/export/:resource', guard('read'), handler);
router.post('/sort/:resource', guard('update'), handler);
// and never assume list order after merging permissions
if (allowed.includes('*')) allowed = allFields;02 · Run it on your appThe check
Do any of your non-CRUD POST routes (export, search, preview) run permission checks as if they were creates?
If the honest answer is no or not sure, this is worth a look before it reaches production.