Each section in admin console has associated permission, that is checked before displaying it.
For example user list has "in-portal:user_list" section and "in-portal:user_list.view". This is most common case, when section name is also part of permission name for this section.
However it's allowed to declare tree section in one unit, but tell it to check permissions based on other unit. This can be done via "perm_prefix" option in section definition. During admin tree drawing this option is processed, but during tab printing via <inp2:adm_ListTabs .../> tag it is ignored.
This will result in admin tree section being printed, but tabs not printed.
Ready for testing.