Owners and authors
Two backoffice roles, where the line runs and why it is drawn on the server.
The cut
The owner may do everything: offers, orders, accounts, settings. The author maintains courses — their own. They see neither orders nor offers nor accounts, not even greyed out.
Why on the server
A role the interface alone knows about is not a role. Call the address directly and you would get through. The check therefore sits at the API; the interface merely also hides what would not work anyway.
Denied means denied, not non-existent
An author opening an owner surface gets a clear refusal — not the claim that the page does not exist. They work here, they know orders exist; pretending otherwise would be silly.
Lists are filtered, not locked
An author's course list shows their courses. Not all of them with an error on opening — that would be a list consisting of dead ends 90 per cent of the time.