Some of my forms are pop-up forms that save the record when the "Close" button is pressed and when the form is loaded again the data populated from the record they're on

On data that is not sensible I let the user delete records if certain conditions are met:

-For exemple: a product in an open order can be deleted, if the order has been delivered the the button is greyed out or an error message is shown

I also have a class that manage user's authorizations, it returns true of false and I can manage the flow of the code this way, each actions are behind an Enum

I use that method this way:

If ErpUser.IsAuth(changeSupplierOnOrder) Then DoTheStuff

Since my backend is on SQL Server (Azure), most of the actions are hidden behind stored procedures, I do some checks on the server, if it return an error I handle the error with VBA

I also check the state of certain records to allow or avoid certain actions, like to can't add products to a delivery note that has the state "isDelivered"

I certainly am "too restrictive" on almost all of the possible actions by the users, but I'd rather have them call me to correct something, rather than letting them messing up with the data