Authentication does not replace authorization on each request

A logged-in customer may request another customer's order, so identity alone cannot justify access.

The server must evaluate whether this caller may perform this operation on this specific resource.

OWASP requires permission validation on every request, regardless of how the request was initiated.

I would centralize default denial while keeping resource ownership and operation-specific rules explicit in application policy.

If inputs need validation, then integration tests should also exercise rejected operations across actual service boundaries.

A hidden button provides interface guidance, but it cannot enforce permissions against independently constructed requests.

Test forbidden actions as carefully as successful ones, including access attempts against another user's resources.