For both of these, there's backend-enforced access, so it's not without backend logic. With Supabase for example, the feature is called row-level security.

The client can fire requests to Supabase, but Supabase runs additional queries on the back-end that determine whether an incoming request is allowed or not.

A simple example would be that a client is only allowed to read, write or update a row if the value in the UserID column is the same as the requesting authenticated user's.