Permissions are not cosmetic
Hiding a button is never treated as authorisation. Direct requests must pass the same tenant and resource checks.
Feature
Limited availabilityTeam collaboration uses server-enforced roles, active memberships and resource checks. Availability is controlled while the hosted workflows are monitored.
Hiding a button is never treated as authorisation. Direct requests must pass the same tenant and resource checks.
Material membership and role changes produce protected audit records.