Roles & permissions

Permissions drive both the sidebar and the route guards, so a hidden page cannot be reached by typing its URL.