A hidden button is not a permission

You ask for an admin area. Your AI tool produces {user.isAdmin && <AdminPanel />}, which is correct for hiding the interface and does nothing for access control. Anyone can open developer tools, set isAdmin to true, and the panel appears.

Whether that matters depends entirely on whether the server checks again. If it does, they see an admin interface that returns errors. If it does not, they have admin access.

For every action behind a role check, find the server-side code that runs it and confirm it independently verifies the role. Not the request body, not a header the client set — the role as stored in your database for the authenticated user.

With Supabase, that means a row-level security policy that reads the role from a table, and not a filter added in the client query.

The same applies to plan === "pro" checks. A plan gate in the browser is a suggestion. If a premium feature calls an endpoint, that endpoint has to check the subscription itself.