A model returns a well-formed request to refund an order. Which component should make the…

A model returns a well-formed request to refund an order. Which component should make the final decision?

1. Application code that authenticates the user, authorizes the action, and checks business rules
2. The model, because well-formed output proves that the request is permitted
3. The JSON parser, because successful parsing establishes the user identity