How can Broken Access Control be exploited?

select the correct answer.

a$.$ When the attacker changes the parameter value, which directly refers to a system object for which he is unauthorized

b$.$ When the attacker changes the parameter value, which directly refers to a system object for which he is authorized