Where Order-Ownership Scoping Actually Has to Live

A get_order(order_id) tool currently queries the full orders table with no owner filter — any caller can pass any order_id and get that order back, regardless of who they are. You need to guarantee, structurally, that one user can never retrieve another user's order, even if the model is jailbroken or misprompted into trying.

Where should that scoping be enforced?