Index: src/middleware/auth.js
===================================================================
--- src/middleware/auth.js	(revision bf61be79c5c52ac6251edc4cb25feaba05e01f1f)
+++ src/middleware/auth.js	(revision 640b39c77691f7bb8ddb40f536fc678f88b8df8d)
@@ -2,4 +2,6 @@
  * Auth middleware
  */
+
+import db from '../config/database.js';
 
 /**
@@ -42,2 +44,25 @@
   next();
 }
+
+// Mag de ingelogde user de HUIDIGE site (res.locals.site) beheren? god altijd;
+// anders alleen de owner van die site. Gebruikt voor site-gescopete beheerroutes
+// die een artiest via /user/<eigen-slug>/admin/... bereikt (res.locals.site is dan
+// z'n eigen site; een vreemde slug levert een andere site -> 403).
+export function requireSiteManager(req, res, next) {
+  if (!req.session?.user) return loginRedirect(req, res);
+  const u = req.session.user;
+  if (u.role === 'god') return next();
+  const site = res.locals.site;
+  if (site && site.owner_id === u.id) return next();
+  return res.status(403).send('Geen toegang tot deze site.');
+}
+
+// Idem, maar de site wordt bepaald door de :slug-parameter (bv. site-edit).
+export function requireSiteManagerBySlug(req, res, next) {
+  if (!req.session?.user) return loginRedirect(req, res);
+  const u = req.session.user;
+  if (u.role === 'god') return next();
+  const site = db.prepare('SELECT owner_id FROM sites WHERE slug = ?').get(req.params.slug);
+  if (site && site.owner_id === u.id) return next();
+  return res.status(403).send('Geen toegang tot deze site.');
+}
Index: src/middleware/render.js
===================================================================
--- src/middleware/render.js	(revision bf61be79c5c52ac6251edc4cb25feaba05e01f1f)
+++ src/middleware/render.js	(revision 640b39c77691f7bb8ddb40f536fc678f88b8df8d)
@@ -13,4 +13,5 @@
 import { fileURLToPath } from 'url';
 import ejs from 'ejs';
+import db from '../config/database.js';
 import PermissionsService from '../services/PermissionsService.js';
 import { PLATFORMS as PLATFORMS_CATALOG } from '../services/PlatformIcons.js';
@@ -36,7 +37,14 @@
   const isPartial = req.headers['hx-request'] === 'true' || req.query.partial === '1';
 
+  // Bezit deze (niet-god) user een eigen site? Bepaalt of 'ie een "Beheer"-
+  // ingang ziet (artiest-zelfbeheer). god ziet beheer sowieso (op rol).
+  const _u = req.session?.user || null;
+  const userOwnsSite = !!(_u && _u.role !== 'god' &&
+    db.prepare('SELECT 1 FROM sites WHERE owner_id = ? LIMIT 1').get(_u.id));
+
   // Common locals
   const locals = {
-    user: req.session?.user || null,
+    user: _u,
+    userOwnsSite,
     site: data.site || res.locals.site || null,
     audioTracks: data.audioTracks || res.locals.audioTracks || [],