Formbuilder security : "user based" vs "Form based"

Question

I can't figure out how to take advante of "User based" security option in Formbuilder, and did not find relevant documentation.

An email is sent using a token such as {afform.afformTestLink}

The contact details are autofilled with current user details

I would expect such user to be able to modify only :

• his own data
• data of his children (with an established relationship between parent and child, in which the parent has permission to modify a child)

It is however ok if he can create new children and new parents (such as his partner)

Problem :

1. using "user based" instead of "Form based" : autofill does not work
2. the user (logged in because he clicked on the email token he received from civimail) can update any existing contact

I am wondering if the problem comes from allowing anonymous users in the form authorization ?