Do both. Don't give the users with less access the impression that they can do a task when you're going to prevent them from doing it. And check ACL before performing operation just in case some wiseacre fakes a link to do it anyway.

...roboticus