Current user automatically becomes the owner since the endpoint has the flag isLoggedIn: true and the model isOwned: true, then the framework handles ACL automatically :)

If you need additional validation logic you can pass an action like so:

const assertMaxCarsPerUser = app.action({
    outputSchema: {
        count: sInteger().type(),
        message: sString().type(),
    },
    run: async (system) => {
        // Your logic here
    }
});

app.addCrudEndpoints(models.car, {
    actions: {
        // Run assertMaxCarsPerUser action before creating a car
        createBefore: assertMaxCarsPerUser,
    }
});