A batch get-by-id endpoint can leak records your list filter would hide

List pages usually apply a tenant and role filter. Batch endpoints often skip it. The client sends...