Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Full-stack candidates often know to hide buttons, but the deeper point is that UI affordances and server authorization are separate layers with different jobs.
I would return the current user's roles or capabilities from a current-user endpoint, then use them to shape navigation, buttons, and admin links. The UI can prevent obvious dead ends, but API endpoints still authorize every protected action. If a user is unauthenticated, the app redirects to login. If authenticated but forbidden, it shows a permission-aware message instead of pretending the resource does not exist unless hiding existence is part of the security model.