Frontend visibility is not authorization

Hiding a button in the UI is not authorization.

A user who never sees Delete can still call the delete API if your server trusts the client. Display logic only shapes the interface. It does not decide who may act on a resource.

Enforce every sensitive request on the server with subject + action + resource checks. Keep the UI honest for usability — but never treat a hidden control as a permission boundary.