Simple example: we have support staff that are allowed to view any customer record but only by making a text search on their email with a precise match. We rate

Simple example: we have support staff that are allowed to view any customer record but only by making a text search on their email with a precise match. We rate limit their requests as well. But we don't even want them to view one customer who doesn't need help if we can avoid it. So using UUIDs is a good way of covering this case.