Role base permission: Hide Unauthorized Sections Instead of Showing Permission Warnings
I created a limited end-user admin account so an HR manager can log in and review user productivity data. I assigned this user a custom role that only allows access to productivity tracking.
When logging in as this user, all permitted sections function correctly. However, all sections where the user does not have access are still visible in the UI and display the message: “You do not have permissions to view this section.”
This behavior is confusing for end users, as they must navigate through many irrelevant menu items to reach the areas they are authorized to use. It also creates unnecessary friction, since users will naturally request access to sections they can see — even when they should never have access (for example, VPN tunnels or network configuration).
From a usability and security perspective, the expected behavior should be:
- If a user does not have permission to a section, that section should be completely hidden from the UI.
- Only authorized sections should be visible in navigation and menus.
This would significantly improve the end-user experience, reduce confusion, and prevent inappropriate access requests for sensitive administrative areas.
Comments
0 comments
Please sign in to leave a comment.