"Stack Management" menu + settings page visible for custom role that only has Dashboard read access

[boutcher]

Kibana version: 7.9.1

Describe the bug: I've defined a role with custom space privileges, where the role only has read access to dashboards and visualizations. When looking at the menu for a user assigned to that role, you see dashboards, visualizations, and ALSO "Stack Management", which is the furthest thing from their permissions you'd expect them to see. Why is this? I've got two screenshots that show the issue below.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[azasypkin]

Thanks for filing this issue @boutcher !

I'm pretty sure it works as "intended" (in a sense that's old known thing and that it doesn't really give any additional access to the user with such role) and we finally fixed this in 7.10 with #67791 (see this issue for the details of behavior you're observing). But I'll let @legrego to confirm and close this issue if so.

[legrego]

Yeah, this was a long-standing limitation of the existing privilege system. #67791 will automatically hide management sections based on your cluster and index privileges. If you don't have access to any management sections, then the management app will be hidden altogether. Hope this helps!