When authenticated user in a particular role is trying to access a page (by manually typing URL) to which the user's role does not have permission: It is better to show an access denied page or redirect the user to the landing page ? Need answers from UX and security perspective.
There's a 3rd option for security concerns: denying a page exists
Working on enterprise software, I've come across feature request for customers who used our platform:
Customers who do not want to show or hint to an unauthenticated (or forbidden) user that a certain type of content even exists for those who do not have permission.
So instead of a '403 Forbidden' page, the solution was to give a 404. We kept the wording vague, with a link to the homepage, login form upper right, and a search field.
Here's an example from a Github 404 page (although it's cheeky, which might not be appropriate for your site).
You may not have the same security or intellectual property concerns, so in that case a 403 page would at least let them know that further permissions are needed (But they know there's content that exists).
Directing users to the homepage will not inform them of their insufficient permissions and they may mistake this for content that's not found, or make them think they have the wrong URL, when in actuality it's a permissions issue.
Due to our (and our customers) security concerns we concluded that a 404 is a better solution.