Permissions issue

Question

According to the teacher's code, if the system administrator adds all submenus, and the developer cancels the two permissions of the administrator to save and the administrator to add, test, these two permissions are still available, according to the code I only see the code It only loads the menu according to the permissions, but does not restrict the functions according to the permissions. In the existing code, the key functions such as saving and deleting on the page, or the third-level menu cannot be controlled, and only the function of displaying the first-level and second-level menus can be controlled?