If a user doesn't have permission for executing an operation there's no lock icon anymore and the button is enabled.
In the past there was a lock icon and the button was disabled. The only hint to the user that the operation is disabled is red background in the Operation result (and 403 status code when observed in the network tab)