CBA , does it need backend coding

Hi all ,

I have created different adaptations ,and tested via passing parameters in URL . I can see different output   for ROLE = MANAGER .

My Ques : In real scenario ,if Manger tries to access web application , do we need to do some back end code as well ,Since making modification in URL is very easy and anyone can do .

How to control it from back end code . Please guide.