- Mount show, create, update, and delete behind the backend permission check - Run controller and model hooks once per operation and roll back on failure - Treat missing and out-of-scope records the same, including idempotent delete