Access control verifies, for each request and on the server side, that the authenticated user has the right to perform the action on the requested resource. Hiding a button is not enough: the API must deny access to other people's resources, with deny by default.
Example
if commande.client_id != user.id: abort(403)