React should focus on interface and interaction. Express routes should not contain every business rule. Database models should not become the only place where validation exists. External services should be isolated behind clear adapters.
Model the business language
Use names that match the real workflow: inquiry, booking, listing, order, approval, member, or lesson. When the code reflects the business language, requirements and errors become easier to discuss.
Good architecture makes the next change easier to locate, understand, test, and reverse.
Treat authorization as a business rule
Authentication answers who the user is. Authorization answers what that user may do to a specific record in a specific state. Put those rules close to the use case and test the denied paths as seriously as the successful ones.