← BackReference (opens in a new tab)

The hidden admin button

The interface hides an action but the backend still accepts it. · PM Drills · 09 · 30 sec–2 min

The hidden admin button · 30 sec–2 min

Situation

Members cannot see the Delete Workspace button.

A tester sends the underlying request directly and successfully deletes a workspace without admin rights.

Think before scrolling

What failed, and what must change?

Explain why a frontend fix is insufficient. What related paths deserve checking?

How a strong PM thinks

The authorization boundary is missing.

The server must verify the caller's authority for the specific workspace and operation. Hiding the button helps usability but cannot enforce permission.

Contain the issue and investigate affected operations, audit records, and whether any real resources were changed. Review both the denied state in the UI and backend enforcement. A correct visual state cannot compensate for an unprotected action.

Takeaway

Enforce permissions where the action happens.

Authenticated identity and visible controls are not enough to authorize a resource change.