What you may do follows from your role on the server — the browser does not choose it. Every guard is enforced by the service, not by which buttons are showing: no session is refused with a 401, the wrong role with a 403.

There are two kinds of account while Directus is being retired. A control-plane account is checked here and is the one to use. If your address has no control-plane account yet, the sign-in falls back to Directus, which is why an address that works on the portal may still work here. ⚠️ They are different accounts and may have different passwords — the fallback is a bridge, not a link between them.

Anything that changes the record is previewed first. You see exactly which rows would change, and nothing is written until you confirm.