Protect api routes using JWT or Sanctum by Associated User_ID only

I'm logging in as a verified user in my simple application. However, when I postman the api routes with another token from another user, I can manipulate the records in the database. How to prevent other user manipulates the data?

Problem: Other users can perform operations even though they are not associated in the current request.

Goal: Only the user with the token and have the same id in the user_id in friend table must perform CRUD operations.

Controller

public function cancelRequest(FriendRequest $request)
{
	$friend = Friend::where('user_id', $request->user_id)->where('friend_id', $request->friend_id);
	if($friend->exists())
            {
                $friend->delete();
                return response()->json([
                'message'=>'Friend request successfully deleted!'
                                ]);  
            }
}

api.php

Route::group(['middleware' => ['auth:sanctum'], 'as' => 'api.'], function() {

    Route::group(['middleware' => 'verified'], function()
    {
        Route::post('/cancel-request', [FriendController::class, 'cancelRequest']);
    });

	Route::post('/logout', [AuthController::class, 'logout']);

});