Your background job checked permissions when it was queued. Who is it acting for when it runs?

A pattern I keep running into: the API handler checks that the user can export the report, delete the...