Data security is not done in the interface: hiding a button protects nothing. Permissions apply on the source (SharePoint permissions, Dataverse security roles), and the app displays what the user is allowed to see. Data loss prevention policies limit connector combinations.