Require database import form controls to declare update authorization against the resource and add coverage to prevent unguarded controls.
Andras Bacsai