# Does the Admin preview persona grant real permissions?

Canonical: https://uvilno.com/answers/does-admin-preview-grant-real-permissions
Updated: 2026-10-27

Uvilno's Guest, Member and Admin preview selector changes presentation only. It can reveal declared role-specific views, but cannot alter the app visitor's identity, database ownership or server permissions. Administrative authorization must be implemented and verified; hidden controls and client-side role labels are not security boundaries.

The preview selector is useful for reviewing information hierarchy and role-specific states without logging the creator out. A real app must still authorize every read and mutation using its actual app session. Client-side setRole cannot promote a visitor or expose another visitor's records.

When asking for an admin experience, define the actual permitted operations and supported server authorization. If the product lacks the requested multi-user management capability, the interface should explain that boundary rather than show a convincing control that secretly has no legitimate authority.

## What to verify

| Check | Published behavior | Verification |
| --- | --- | --- |
| Persona | The selector changes preview presentation. | Switch views while checking the unchanged app user. |
| Server access | Real identity and record ownership still apply. | Attempt an unauthorized mutation with a disposable visitor. |
| Creator session | The builder's account is separate. | Confirm the creator remains signed in after view changes. |

## Steps

1. Review each persona's visible controls.
2. Write the separate server permission requirements.
3. Test prohibited actions through actual authenticated requests.

## Editable starting brief

Plan a customer-facing task app and an admin presentation review. Clearly label preview roles as presentation only. Do not allow client-side role changes to grant access, and preserve the signed-in app visitor and builder identity. Describe any unsupported administrative operation before adding its control; test real record ownership separately.

## Sources

- [Uvilno public SDK documentation](https://uvilno.com/docs)