Limiting Action Due To Permissions

How would you prevent someone from performing an action on the front end (Obviously this would be enforced on the back end, but I'd imagine you don't want the user thinking they can perform an action if they can't) when they are not allowed to perform the action because they don't have the permissions for it? How would this change if they sometimes have permissions to perform the action but not in this specific case.

Two examples:

  1. A user may be a limited administrator of an account. Each user has a role that determines what permission they are allowed to perform. As a limit administrator he may be able to create new roles or edit existing ones. However, he obviously can't edit his own role or he would be able to give himself permissions he doesn't have.

  2. A user is a standard user of the account and has a role that gives them permission to view something but they cannot edit or delete it.

The way I see it there are 3 possible options:

  1. Hide the button so the user can't perform the action. This seems like it would be good if the user can never perform the action, but can be inconsistent if they can only sometimes perform that action as in the first case where they can edit roles but not their own role.

  2. Disable the button if the user can't perform the action. This provides consistency, but may confuse the user as to why they can't perform the action (especially if they usually can). This can maybe be fixed with a tool tip explaining why the button is disabled, but this seems strange and un-intuitive.

  3. Keep the button enabled, but when it is clicked show a popup explaining the action can't be performed because they don't have permission to do it. This one lets the user know why they can't perform the action, but just seems like I am misleading the user into thinking they can perform the action and that it could get annoying.

These are the 3 options I was able to come up with, is there a better way to do this. Is there any research on how to display an action when the user doesn't have permission to perform it?

Tags: