>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3531858. --> Reported by: [penyaskito](https://www.drupal.org/user/959536) Related to !253 >>> <h3 id="overview">Overview</h3> <p>In the context of <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/experience_builder/issues/3529895" title="Status: Closed (fixed)">#3529895: Provide the client with `create` operation access information similar to #3516657</a></span>, we are not correctly handling cache metadata as described in <a href="https://git.drupalcode.org/project/experience_builder/-/merge_requests/1178#note_539006">a review on !1178</a>:</p> <blockquote><p> The `$this-&gt;currentUser-&gt;hasPermission(PageRegion::ADMIN_PERMISSION),` access control checks technically also don't bubble cacheability. BUT! They all are guaranteed to vary only by `user.permissions`, so they're not adversely affected. By contrast, "entity create" access is alterable.</p> <p>However, `(Node|Page)AccessControlHandler::checkCreateAccess()` both also vary only by `user.permission` by default, so in &gt;95% of scenarios, this is accurate. </p></blockquote> <h3 id="proposed-resolution">Proposed resolution</h3> <p>Refactor <code>\Drupal\experience_builder\Controller\ExperienceBuilderController::__invoke</code> to handle cache metadata properly.</p> <h3 id="ui-changes">User interface changes</h3> > Related issue: [Issue #3529895](https://www.drupal.org/node/3529895) > Related issue: [Issue #3452581](https://www.drupal.org/node/3452581)