SAMPLE EVIDENCE for AR-02 (made-up app Tidyhaus; not a real review)

/admin/users opened as user B (screenshot described): the layout loads with an empty table and 'Not allowed'.