Not exactly. Anyone can visit the `/proposals` route, the authorization for create RFP is all API, the frontend simply hides the tab taking you to the route.