Hi
The first attached image shows the Device Inventory dashboard UI for a user, "observer", with the ROLE_OBSERVER role.
Note that the "Set ..." and "Delete" buttons are displayed. These are all write actions that should not be possible for a user with a role of ROLE_OBSERVER. The second image attached shows the outcome of attempting to actually Delete, which displays an error message.
It is contrary to established security and UI design practices to display options in a UI for a user who does not have the permissions to use those options. It is incorrect to display such options, allow the user to attempt to use them, and then display an error message.
At the very least, the options should be greyed out indicating that they are not actually available.
It is insecure to reveal to a user any more information about the UI, and so the capabilities of the system, than their assigned role gives them permission to access.
Regards
Nathan
