We have Jenkins configured so that only logged in users can make changes. We have promoted builds set up to let anyone approve a manual promotion. Unfortunately that means people have been approving promotions without first logging in.

I think the plugin should be checking whether a user has modify permissions before displaying the 'approve' button, i.e. same logic that Jenkins uses for the 'build now' button.