Your identity, role and project access are resolved server-side from this session - the interface itself holds no authority.