I like hateoas as a concept but how can you maintain that in production scale???

we need to maintain access control and output that in client which is good but that move bulk of engineering into backend that would harder and harder given many scenario noo???