Sometimes you need to have some controls when your Business needs mandates that only certain users have the ability do some tasks. There are a few basic methods how this is done.
1. Disabling - The controls remains visible but are inert to user input. and displayed with “grayed-out” appearance.
2. Hiding - The controls are removed for those users.
3. Messages - The controls are there but user input results in an error message and the input is discarded.
Each one works well, depending on the circumstances and usually there's no standard practice per se.
However, disabling controls has the advantage of making the UI stable. Whatever the state of the system, controls remain in the same place and displayed the same way. Thus it's easier for any user to remember things.
OTOH hiding the controls might minimise the clutter on the page.
Also with disabling, the user becomes aware that the control is there 'potentially available' in the system but he cannot access it due to his current permissions.
Messaging - Error messages as the availability control is the last resort. Personally I prefer Disabling.
