Authorisation
Also called authz, authorization, permissions
Deciding what a known user may do, on this thing, right now. The server has to decide on every request, because anything in the browser can be changed by the person using it.
It's the check that has no visible effect when missing. The honest user sees the same screen either way, so nothing in a normal demo gives it away.
Say it to your agent
“Put the permission check in one middleware that denies by default, so each route has to say who may use it. A new route with no rule should return 403, and I want a test proving that.”