Privileges need to be confirmed on the server even if they're verified on the client.