Azure DevOps Custom Extensions - Work Item Form Extension - Add Security

I'm extending the Work Item form to include a new Page for some custom actions like this:
https://learn.microsoft.com/en-us/azure/devops/extend/develop/add-workitem-extension?view=azure-devops

I'd like to only allow certain users to interact with the new Tab and load it. What's the best way to add security at the user level? I could so some "hack" to only allow the data to load if the user exists in an array of allowed users published with the Extension, but I was hoping to have something more clean/configurable than that.

I can't give you a definite answer, but I have a few hunches of what's possible:

1. The permissions API - permissions in Azure DevOps use a scope and a token, I think technically you can create a ACL with a customized token to store your permissions. Your extension should then query that specific access control list to decide whether to render or not. This has the advantage that inheritance, group membership etc would work as well.

2. The extension storage API - extensions can store arbitrary data using the extension storage API. You could store your 'ACL' there.

You can register a custom section in the project or organisation where you can render a UI to manage these permissions. I suspect you might be able to use a built-in permissions control, but again, speculating.