Users see the option to add ("+") and remove ("-") target permissions in the Access Catalog even when they do not have the required access rights.
The default configuration for the cart mode allows these options to be visible regardless of specific user permissions until strict mode is enabled.
To change this behavior, enable strict cart mode:
strict_cart_mode attribute.true.