Безопасность доступа к объектам БД

@Override
public UserDTO saveUserData(@RequestBody UserDTO request,
                            @RequestHeader("Authorization") String sessionId,
                            HttpServletResponse response) {
    UserInfo userInfo = mellophone.user(sessionId);
    return userService.saveUserData(new SystemCallContext(), userInfo, request);
}

@Override
public UserInfo user(String sessionId) throws AuthException {

    String url = UriComponentsBuilder.fromUriString(properties.getMellophoneUrl())
            .path(ISAUTHENTICATED_PATH)
            .queryParam(SESID_PARAM, sessionId)
            .build()
            .toUriString();
    try {
        UserInfo userInfo = this.restTemplate.getForObject(url, UserInfo.class);
        userInfo.setStudent(true);
        userInfo.setOriginatorSid(userInfo.getSid());
        return userInfo;
    } catch (HttpStatusCodeException ex) {
        throw new AuthException(ex);
    }
}

@Log4j2
public class SecureUsersCursor extends UserCursor {
    private final UserInfo userInfo;

    public SecureUsersCursor(CallContext context, UserInfo userInfo) {
        super(context);
        this.userInfo = userInfo;
    }

    @Override
    public boolean tryGet(String objectSid) {
        if (isAuthorized(objectSid)) {
            return super.tryGet(objectSid);
        } else {
            throw new St2ApiException("User is not authorized for making requested changes");
        }
    }

    private boolean isAuthorized(String objectSid) {
        return this.userInfo.getSid().equals(objectSid);
    }
}

SecureUsersCursor userCursor = new SecureUsersCursor(context, userInfo);