Index: ChapterX.Application/Story/Commands/AddRequest.cs
===================================================================
--- ChapterX.Application/Story/Commands/AddRequest.cs	(revision d300631ac3354730c3b03cb7b160974af50e7894)
+++ ChapterX.Application/Story/Commands/AddRequest.cs	(revision 0b502c2664f4d6c64626f3394b4f1dc540e0aa9b)
@@ -1,6 +1,14 @@
 using MediatR;
+using System.ComponentModel.DataAnnotations;
 
 namespace ChapterX.Application.Story.Commands
 {
-    public record AddRequest(bool MatureContent, string ShortDescription, string? Image, string Content, int UserId, List<string> Genres) : IRequest<AddResponse>;
+    public record AddRequest(
+        bool MatureContent,
+        [Required][MaxLength(500)] string ShortDescription,
+        [MaxLength(2048)] string? Image,
+        [Required] string Content,
+        int UserId,
+        List<string> Genres
+    ) : IRequest<AddResponse>;
 }
Index: ChapterX.Application/Story/Commands/DeleteHandler.cs
===================================================================
--- ChapterX.Application/Story/Commands/DeleteHandler.cs	(revision d300631ac3354730c3b03cb7b160974af50e7894)
+++ ChapterX.Application/Story/Commands/DeleteHandler.cs	(revision 0b502c2664f4d6c64626f3394b4f1dc540e0aa9b)
@@ -22,4 +22,7 @@
                 return new DeleteResponse(false);
 
+            if (story.UserId != request.CallerId)
+                throw new UnauthorizedAccessException("You do not own this story.");
+
             await _storyRepository.DeleteAsync(story, cancellationToken);
 
Index: ChapterX.Application/Story/Commands/DeleteRequest.cs
===================================================================
--- ChapterX.Application/Story/Commands/DeleteRequest.cs	(revision d300631ac3354730c3b03cb7b160974af50e7894)
+++ ChapterX.Application/Story/Commands/DeleteRequest.cs	(revision 0b502c2664f4d6c64626f3394b4f1dc540e0aa9b)
@@ -3,4 +3,4 @@
 namespace ChapterX.Application.Story.Commands
 {
-    public record DeleteRequest(int Id) : IRequest<DeleteResponse>;
+    public record DeleteRequest(int Id, int CallerId) : IRequest<DeleteResponse>;
 }
Index: ChapterX.Application/Story/Commands/UpdateHandler.cs
===================================================================
--- ChapterX.Application/Story/Commands/UpdateHandler.cs	(revision d300631ac3354730c3b03cb7b160974af50e7894)
+++ ChapterX.Application/Story/Commands/UpdateHandler.cs	(revision 0b502c2664f4d6c64626f3394b4f1dc540e0aa9b)
@@ -22,4 +22,7 @@
                 return new UpdateResponse(false);
 
+            if (story.UserId != request.CallerId)
+                throw new UnauthorizedAccessException("You do not own this story.");
+
             story.MatureContent = request.MatureContent;
             story.ShortDescription = request.ShortDescription;
Index: ChapterX.Application/Story/Commands/UpdateRequest.cs
===================================================================
--- ChapterX.Application/Story/Commands/UpdateRequest.cs	(revision d300631ac3354730c3b03cb7b160974af50e7894)
+++ ChapterX.Application/Story/Commands/UpdateRequest.cs	(revision 0b502c2664f4d6c64626f3394b4f1dc540e0aa9b)
@@ -3,4 +3,4 @@
 namespace ChapterX.Application.Story.Commands
 {
-    public record UpdateRequest(int Id, bool MatureContent, string ShortDescription, string? Image, string Content) : IRequest<UpdateResponse>;
+    public record UpdateRequest(int Id, bool MatureContent, string ShortDescription, string? Image, string Content, int CallerId = 0) : IRequest<UpdateResponse>;
 }