Trust boundary
Client-side checks are UX only — the server recomputes from the session on
every request; a bitfield in a cookie is a cache, never an input to a decision. A
bit's meaning is permanent (rename freely, never reuse). Capability ≠
ownership: has(MANAGE_MESSAGES) || msg.authorId === me.id — the second half is
your app's.