You should develop all the security measures firstly on the back end.
The rails serializers determine what data gets sent.
The Guardian protects what actions are allowed.
All of this is managed by the Rails Controllers.
It doesn’t matter what junk the front end sends or what it requests to retrieve, because those elements protect the server.
You can mirror this with front end behaviour, but the front end is not the gatekeeper.
Check out a few of the larger plugins and you will see examples of Serializers and use of the Guardian.