one answer instead of a wall of denials

A staff dashboard has to know what the person in front of it may see before it renders anything. The direct way is to ask about each protected area and see which answers come back. Every one of those questions is legitimate, and the browser records every refusal as an error — so the least privileged role opened its dashboard behind a wall of failures that were all correct.

The change inverted it: ask once. A session answer returns the whole role set in a single response, and the shell asks that first. The area-by-area probes survive as a fallback rung, because that answer did not exist when the work started, and a surface that cannot render without a server change is not shipped.

Two details carry most of the value. A probe that receives something which is not a valid answer is classified as not available yet rather than as a lost session, because an unbuilt endpoint answering with the application shell is otherwise indistinguishable from a logout. And the ladder runs exactly once per page load, because the view re-runs dependency-less effects on every render and an unguarded ladder would probe on every frame.

Role handling was made explicit too: the two broadest role names count as equivalent to the operational one in capability checks, since the session answer returns raw names while probes land on a normalised one, and unknown roles are filtered from the interface rather than rendered as a mystery.

Cost: two rungs to maintain, one of which exists only until the server surface lands.

What it proves: they optimised the quiet failure, and refused to let "not built yet" pass for "not allowed".