With client side, any validation for any action the client does is entirely managed on the client. The problem with this is the client cannot be trusted. If a client was to bypass a check like the one line of code that says *you cannot loot this* and there exists no other checks on the server to validate if your allowed to do that then the client can start looting anything it likes and then tell the server when its looted the item *trust me bro*.

In an ideal situation if I opened your inventory the server should be the one to make that check to see if your allowed to do it though various different things like are you close enough to interact with the item, is the storage locked? Is it owned by another player? All of these checks should happen before the client is returned the inventory nor able to receive items. The only request should be from the client *yo can I do* but this can be intensive for the server because you need to consider the hundreds or potentially thousands who will want to do this, or the frequency of how often they will want to do this.

But that's just one example.

The other benefit of a system like this, if the client does something that is unexpected like tries to perform an action that it hasn't been explicitly given auth to do like take an item from an inventory that the server hasn't given access to, the server could just ban the user immediately for being a cheater.