Permissions belong in the workflow
The interface and the backend must agree on who can do what.
A hidden button is useful interface guidance, but it is not an access check. The application must verify the user's identity and permission when it reads or changes a protected record.
Map permissions to real actions: read a draft, edit a document, publish a result or change a role. Include ownership, not just broad job titles. Test an existing session after its user's role changes.
When a request is rejected, keep the message helpful without revealing information the user is not entitled to see. Access rules should survive direct requests and alternate navigation paths.