"Except this was all client-side. The Angular app checked the JWT for a NO_ROLES marker and rendered the access-denied page. The backend APIs? They didn't check anything. They just served whatever you asked for."

This was common at my previous job, so many things checked the roles in the JWT and didn't verify with the backend