---
title: "Permissions, flags and failures · Agent Wranglers"
url: https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures
updated: 2026-10-20
licence: "All rights reserved"
---

# Permissions, flags and failures

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> The server decides who may do what, and the screen follows. Contain each crash, time out slow requests, and survive expired sessions and lost networks.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers app interface playbook: https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures`.

## Required

- [Enforce permissions on the server](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/server-enforces-permissions): Treat hidden and disabled buttons as a convenience only. The server checks the user's permission on every request, whatever the screen shows.
- [Survive an expired session](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/session-expiry): When a session expires, keep the screen and the unsaved work. Let the person sign in again in place, then repeat the request that failed.
- [Contain each crash to its panel](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/error-boundaries): Wrap each route and each independent panel in an error boundary. One broken part then shows a fallback, and the rest keeps working. Report every caught error.
- [Give every request a time limit](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/request-timeouts): Give every request from the screen a time limit, say when a request is slow, and retry only reads and requests with an idempotency key.

## Recommended

- [Let the server say what each user may do](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/capabilities-from-server): Send the actions the user may take on each record with the record, and show controls from that list. Never rebuild the permission rules in the client.
- [Read feature flags before the first paint](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/feature-flags-in-ui): Decide feature flags on the server and send them with the first page or data load. A flagged feature then never flashes in or out. The API checks the same flag.
- [Say when the network is gone](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/offline-behaviour): When the connection drops, say so in a banner and keep everything already loaded on screen. Either queue changes with idempotency keys and send them on reconnect, or block them with a reason.
- [Recover when a new release replaces the old files](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/new-release-reload): When a tab still runs the old release and a code chunk fails to load after a deploy, reload once to get the new release. Keep older files online as [keep the previous build's assets](https://agentwranglers.se/playbook/website/site-architecture/keep-the-previous-build-s-assets) sets.

- Previous: [Feedback and dialogs](https://agentwranglers.se/playbook/app-ui/feedback-and-dialogs)
- Next: [Tests and budgets](https://agentwranglers.se/playbook/app-ui/tests-and-budgets)
- [All chapters](https://agentwranglers.se/playbook/app-ui)