    it "respects custom options" do
      expect(app.as_json(except: :secret)).not_to include("secret")
      expect(app.as_json(only: :id)).to match("id" => app.id)
    end
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.