Each record in a collection stores the user who created it, but this info is by default hidden in the API.
You can expose the UUID of the creator in the API response.
This is a setting per model.
See documentation for Model-Options
As the creator is known for each record, it should be easy to override the
.find() and .update() method according to the article from @sunnyson.