HUMAN VERIFICATION REQUIRED ASVS 8.3.1 Authorization is enforced by a trusted service layer

The application enforces authorization rules at a trusted service layer and doesn't rely on controls that an untrusted consumer could manipulate, such as client-side JavaScript.