Where to securely store custom access rights for a user? Cookies / Local Storage / somewhere else?

Can’t presume to speak to “best”, but what I do is use this idiom to propagate user authentication status across parts of my app that care about it, and Angular route guards to wall off sections of the UI that aren’t appropriate.