If using an employee number as userId — why is this bad from a security perspective?

Using a personnel number as a userId is insecure for several reasons:

• Predictability: Personnel numbers are usually sequential or have a known format, making it easier for an attacker to guess or brute-force identifiers.
• Lack of anonymity: The personnel number is often linked to a real person, which can lead to personal data leaks.
• Vulnerability to attacks: If userId is used in URLs or APIs without additional checks, an attacker can access others' data by substituting different personnel numbers.

It is better to use random or hashed identifiers that are difficult to guess, and to implement strict authorization and access control checks.