Replay captured requests with swapped identities and bumped object IDs to surface broken access control. Use when testing for IDOR or authz flaws.