Keeping permission rules in one place
Early on, the UI hid actions the user could not perform while the API re-implemented the same checks separately. The two drifted. The fix was a single server-side authorisation model, with the API returning the allowed transitions for each record so the UI renders from that rather than duplicating the logic.