with dynamics365-2021-release-wave-1-plan released, the merge button is added to the duplicate detection panel. However, I found that the button is always available even user doesn't have merge permission assigned on the security role / business management / merge