Permissions Are Not Menu Visibility
Invisible does not mean impossible; clickable does not mean allowed.
Menu visibility is an experience layer. Real authorization has to hold across actions, resource ownership, and service boundaries.
Many admin systems understand permissions as “can this person see the menu?” That matters because the wrong entry point creates confusion. But a menu is a sign on a door, not the lock.
In a multi-entity system like HotelByte, the same function can mean different things for platform, tenant, and customer users. Entering a page does not mean operating every resource is allowed. Hiding a button does not replace server-side authorization.
Good permission design separates function access from data scope. Roles decide what kind of action is possible. Resource ownership decides who it can be done to. Frontend hiding serves experience; backend checks serve truth.