Index: ChapterX.Application/Chapter/Commands/AddRequest.cs
===================================================================
--- ChapterX.Application/Chapter/Commands/AddRequest.cs	(revision 877c13c3dd0934c1d31da7988d0d2c2c5925ed55)
+++ ChapterX.Application/Chapter/Commands/AddRequest.cs	(revision 3ae4bab8dcf6c40690ba2765146e7e1f70fa3a2f)
@@ -1,11 +1,12 @@
 using MediatR;
+using System.ComponentModel.DataAnnotations;
 
 namespace ChapterX.Application.Chapter.Commands
 {
     public record AddRequest(
-        int Number,
-        string Name,
-        string Title,
-        string Content,
+        [Range(1, int.MaxValue)] int Number,
+        [Required][MaxLength(200)] string Name,
+        [Required][MaxLength(300)] string Title,
+        [Required] string Content,
         int StoryId
     ) : IRequest<AddResponse>;
Index: ChapterX.Application/Chapter/Commands/DeleteHandler.cs
===================================================================
--- ChapterX.Application/Chapter/Commands/DeleteHandler.cs	(revision 877c13c3dd0934c1d31da7988d0d2c2c5925ed55)
+++ ChapterX.Application/Chapter/Commands/DeleteHandler.cs	(revision 3ae4bab8dcf6c40690ba2765146e7e1f70fa3a2f)
@@ -18,7 +18,10 @@
         public async Task<DeleteResponse> Handle(DeleteRequest request, CancellationToken cancellationToken)
         {
-            var chapter = await _chapterRepository.GetByIdAsync(request.Id, cancellationToken);
+            var chapter = await _chapterRepository.GetByIdWithStoryAsync(request.Id, cancellationToken);
             if (chapter is null)
                 return new DeleteResponse(false);
+
+            if (chapter.Story.UserId != request.CallerId)
+                throw new UnauthorizedAccessException("You do not own this chapter.");
 
             await _chapterRepository.DeleteAsync(chapter, cancellationToken);
Index: ChapterX.Application/Chapter/Commands/DeleteRequest.cs
===================================================================
--- ChapterX.Application/Chapter/Commands/DeleteRequest.cs	(revision 877c13c3dd0934c1d31da7988d0d2c2c5925ed55)
+++ ChapterX.Application/Chapter/Commands/DeleteRequest.cs	(revision 3ae4bab8dcf6c40690ba2765146e7e1f70fa3a2f)
@@ -3,4 +3,4 @@
 namespace ChapterX.Application.Chapter.Commands
 {
-    public record DeleteRequest(int Id) : IRequest<DeleteResponse>;
+    public record DeleteRequest(int Id, int CallerId) : IRequest<DeleteResponse>;
 }
Index: ChapterX.Application/Chapter/Commands/UpdateHandler.cs
===================================================================
--- ChapterX.Application/Chapter/Commands/UpdateHandler.cs	(revision 877c13c3dd0934c1d31da7988d0d2c2c5925ed55)
+++ ChapterX.Application/Chapter/Commands/UpdateHandler.cs	(revision 3ae4bab8dcf6c40690ba2765146e7e1f70fa3a2f)
@@ -18,7 +18,10 @@
         public async Task<UpdateResponse> Handle(UpdateRequest request, CancellationToken cancellationToken)
         {
-            var chapter = await _chapterRepository.GetByIdAsync(request.Id, cancellationToken);
+            var chapter = await _chapterRepository.GetByIdWithStoryAsync(request.Id, cancellationToken);
             if (chapter is null)
                 return new UpdateResponse(false);
+
+            if (chapter.Story.UserId != request.CallerId)
+                throw new UnauthorizedAccessException("You do not own this chapter.");
 
             chapter.Number = request.Number;
Index: ChapterX.Application/Chapter/Commands/UpdateRequest.cs
===================================================================
--- ChapterX.Application/Chapter/Commands/UpdateRequest.cs	(revision 877c13c3dd0934c1d31da7988d0d2c2c5925ed55)
+++ ChapterX.Application/Chapter/Commands/UpdateRequest.cs	(revision 3ae4bab8dcf6c40690ba2765146e7e1f70fa3a2f)
@@ -9,5 +9,6 @@
         string Title,
         string Content,
-        int? WordCount
+        int? WordCount,
+        int CallerId = 0
     ) : IRequest<UpdateResponse>;
 }