I have a microservice architectured application. Where i have a CompanyService, an OrderService and a TransactionSevice. A user logs in and he can load all orders for his company. So the order has a CompanyId. Then it loads all Transactions for that order, so the transaction has an OrderId. I am going through some security thoughts. How can i make sure that the user only loads or saves transactions for the orders that belong to his company. I mean the TransactionService should not need to know about the Company (CompanyId). Is it something i should check just before saving? Eg check that the orderid belongs to the company or is there some other pattern?

Thanks