OrderCloud implements OAuth2 combined with our own notion of roles to control user authentication and authorization at fine-grain level. If you over-privilege your users and attempt to control what they can do via front-end code, you run the risk of technically savvy users circumventing this by making direct API calls.