I know I could allow Post.create for all authenticated users, this would be an improvement on having no permissions however, this would still allow authenticated users to create Posts, while passing in the

userId

for a different user