---
title: "Enforce permissions on the server · Agent Wranglers"
url: https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/server-enforces-permissions
updated: 2026-10-20
licence: "All rights reserved"
---

# Enforce permissions on the server

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Permissions, flags and failures](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures)
- Rule: Treat hidden and disabled buttons as a convenience only. The server checks the user's permission on every request, whatever the screen shows.
- How: Anyone can call the API without the screen, with a browser's developer tools or a script. Check the role for each action and the ownership of each record on the server, as [function access](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/function-access) and [object access](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/object-access) describe. Hiding a route in the client never protects its data.
- Check: For each action the screen hides from a role, a test calls the API directly as that role. Every call gets 403 or 404, and the data is unchanged.

Example:

```ts
test('viewers cannot delete invoices through the API', async ({ request }) => {
  const response = await request.delete('/api/invoices/inv_1042', { headers: { Authorization: `Bearer ${viewerToken}` } });
  expect(response.status()).toBe(403);
});
```

```python
def test_viewer_cannot_delete_invoice(client, viewer_token):
    response = client.delete("/api/invoices/inv_1042", headers={"Authorization": f"Bearer {viewer_token}"})
    assert response.status_code == 403
    assert invoices.get("inv_1042") is not None
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers app interface playbook: https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/server-enforces-permissions`.

- Next: [Let the server say what each user may do](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures/capabilities-from-server)
- [Permissions, flags and failures](https://agentwranglers.se/playbook/app-ui/permissions-flags-and-failures)