As a slight counterpoint to that scenario, the front-end can often just get away with just checking whether the data exists in the response, rather than checkin

As a slight counterpoint to that scenario, the front-end can often just get away with just checking whether the data exists in the response, rather than checking roles. This isn't quite as simple as the SSR alternative, but it at least removes most of the hassle with making sure the permissions match on server and client. However, this doesn't help much when the restricted data is on a separate endpoint, since the app needs to decide whether to make the request in the first place.