UI only reacts to the responses from backend. Of course it has some amount of logic not to show things user doesn't have permission to do anyway.

Regarding the error handling, just return response and show the error. For example if trying to load a dashboard and you get a 403, just display an error.