feat(api): enforce resource-level authorization on global document endpoints