well it is implemented on the backend anyways, but you still need to handle the restrictions on the front-end somehow as well, right? coz backend API and the front-end are not always a 1 to 1 match of resources