Access is scoped by role-based permissions. Sensitive authorization checks and permission loading happen server-side during SSR.