feat(api): enforce resource-level authorization on cv endpoints