A developer implements role-based access control and checks permissions client-side: 'if (user.role === "admin") showAdminPanel()'. An attacker changes their JWT role to 'admin'. The backend API route '/api/admin/users' does not check the role claim. What OWASP category does this represent at the API level?

• A.A02 Cryptographic Failures - the JWT is not encrypted
• B.A04 Insecure Design - the role should not be in the JWT
• C.A07 Identification and Authentication Failures - JWT verification failed
• D.A01 Broken Access Control: the API endpoint fails to enforce authorization. Even if the JWT signature is valid (implying the role claim was legitimately issued), the backend must verify that the requesting user's role permits access to the endpoint - it cannot assume client-side checks are sufficient