Prevent user from accessing Nova by user->role

[GlennBags]

User record has been updated to include a varchar column of role, which can be one of the values from UserRole Enum:

enum UserRole: string
{
    case SuperAdmin = 'Super Admin';
    case Admin = 'Admin';
    case Support = 'Support';
    case Employee = 'Employee';
    case User = 'User';
}

Created Policies for all the models which only provides permissions for non-user roles.

in NovaServiceProvider.php

    protected function gate(): void
    {
        Gate::define('viewNova', fn ($user) => UserPolicy::isUserEmployee($user));
    }

UserPolicy:

public static function isUserEmployee(?User $user): bool
{
        return ! empty($user->role) 
                   && ($user->role === UserRole::SuperAdmin->value
                       || $user->role === UserRole::Admin->value
                       || $user->role === UserRole::Support->value)
}

If I'm logged into my web app as a user with role of "User", ie not one of the above that would classify the user as an employee, I still am able to get to Nova main dashboard. The user is then able to view the Logs and stats for the modules.
Resources correctly is not loading any of the modules, so the user is not able to view that content nor update any of it.
However, I would have assumed with "viewNova" being FALSE, the user shouldn't be able to navigate to the Nova dashboard at all. What am I doing wrong that they can?

[crynobone]

For ease of first time development, Nova does skip viewNova authorization when it detect the application is running as local environment.