Users without Bulk Change Global Permission receives a 404 error instead of a permission error

Issue Summary

When removing users/groups from Bulk Change Global Permission, this removes the Bulk link from the navigation menu and issue navigator.

However, users still see Bulk operation under the sub-tasks panel. This leads them to the regular Bulk Operations interface but results in a 404 page in the last step.

This creates confusion for users.

Steps to Reproduce

1. Step 1 - Created a "Bulk Permission" group and enabled bulk operations only for this group.
2. Step 2 - Tested sub-tasks issue bulk options logged as a member from "Bulk Permission" group and logged as a non-member of this group

Expected Results

Only "Bulk Permission" group members should see the bulk operations option. Users with a direct link (e.g. bookmark) to the Bulk Operations page should be prompted with a permission denied error.

Actual Results

All users can see the bulk operations option in the sub-tasks panel, regardless of the Global Permission. This doesn't allow them to use the functionality though.

Workaround

Currently, there is no known workaround for this behavior. A workaround will be added here when available