Easy
One extra property, no guard at all.
The set 4
Nothing matches thatClear the filter to see everything again.
Send the fields the form never showed you. If the server binds the whole body onto the object, your extra key is as good as the real ones.
Authentication is who you are; authorisation is what you are allowed to touch. Broken access control is the app checking the first and forgetting the second, so an object id, a role field or a hidden admin route is all that stands between you and someone else's data.