And if you use UUIDs for user IDs you're probably using them for other things. The same sort of mistake can happen. The only real defense here is language-lev

And if you use UUIDs for user IDs you're probably using them for other things. The same sort of mistake can happen. The only real defense here is language-level enforcement. Allow declaration of a subtype that is not assignment-compatible with the parent even though it's identical. I don't do any web-facing stuff but the only bits of code that know about things like IDs are the database stuff. All the logic works with classes that contain the ID and relevant data--you always pass the class, not the ID.