CAP Java 3.7.1
Instance-based @restrict conditions were pushed into the query on read, but a CREATE or UPDATE was not checked against them beyond ordinary field validation. CAP Java 3.7.1 added a beta check that also validates input data for CREATE and UPDATE events against the same instance-based condition, rejecting a write that would place a record outside the user's allowed instances with HTTP 400.
Makes stale:
Advice that instance-based @restrict only guards reads and that a create or update payload has to be checked by hand for the same rule. That gap is closable now, behind cds.security.authorization.instanceBased.checkInputData — beta, and Java-only as of this release.