The hidden admin button
The interface hides an action but the backend still accepts it. · PM Drills · 09 · 30 sec–2 min
The hidden admin button · 30 sec–2 min
Situation
Members cannot see the Delete Workspace button.
A tester sends the underlying request directly and successfully deletes a workspace without admin rights.
Think before scrolling
What failed, and what must change?
Explain why a frontend fix is insufficient. What related paths deserve checking?
How a strong PM thinks
The authorization boundary is missing.
The server must verify the caller's authority for the specific workspace and operation. Hiding the button helps usability but cannot enforce permission.
Contain the issue and investigate affected operations, audit records, and whether any real resources were changed. Review both the denied state in the UI and backend enforcement. A correct visual state cannot compensate for an unprotected action.
Takeaway
Enforce permissions where the action happens.
Authenticated identity and visible controls are not enough to authorize a resource change.