Security model and menu access Drupal 8.6.1

I have some menu items  I would like to hide from some users: An administration menu with documentation about site admin; A contributors menu with documentation for contributors. etc.

It appears that Drupal prefers every menu entry to link to something. I have these menus pointing to route:&lt;nolink&gt; and have the content hanging from them, tagged as required to implement https://www.drupal.org/project/permissions_by_term.

The result of this is that the top level menu items are visible to everyone.

Is the Drupal philosophy to create some content/view and assign permissions to that for these top-level menus?
Is the Drupal philosophy to create some content/view and assign permissions to that for these top-level menus?


Obviously there is no hard and fast rule about this, but generally speaking your hunch is correct. Drupal menus expect every link (even a parent) to link to some content. As an example, the "add content" link goes to a page that lists the available content types even though the content types are usually listed under "add content" in the menu anyway. 



I do not believe there is an example in core where a menu link is there only as a parent and does not link anywhere.