The permission management of this course is not perfect and rigorous.

Question

I am very grateful to the teacher for this video, which allows novices to learn a lot. However, the permission management in this course only shows and hides the menu in the sidebar, but the permissions on the page are always open:

For example, role: developer, I do not have permission to add menus, but I can still add editing operations by manually entering the address of adding a menu. There are no restrictions on role permissions in the baseAdmin.php controller. . . I thought about it for a long time and didn't know which way to implement it better. Can the teacher improve the tutorial?,,