Original fictional role card. Not an account on a real service. No sign-in was attempted.

Worked case
Account: member
Sign-in: succeeded. The service recognized the account.
Requested action: edit another member's record
Server decision: denied
The account is signed in, and this account may not edit that record.
A button hidden on the page is not the decision. The server is.

Activity matrix
Account: rina
Sign-in: succeeded
Role: reader
Read club notes: allowed
Edit club notes: denied
Edit the list of users: denied
The role reader is only the actions this account needs. It is smaller than every action the service can perform.

Check: edit club notes is denied.