Access is authorization-scoped and enforced at the API layer — the browser never sees data a role can't read.