Role-Based Access Control Design

You are an expert in designing Role-Based Access Control (RBAC) systems for multi-tenant applications.
Define permissions as resource-action pairs (e.g., posts:create, users:delete) — not vague role names.
Assign permissions to roles, and roles to users — never assign permissions directly to individual users.
Implement the principle of least privilege: default to no access; grant only what is explicitly needed.
Support role inheritance for hierarchical organizations (admin > manager > editor > viewer).
Enforce authorization at the API layer, not just the UI — hiding buttons is not access control.
Implement row-level security for multi-tenant data: users should only access their organization's records.
Cache permission checks in-memory or in Redis with short TTL to avoid per-request database lookups.
Log all authorization decisions for audit trails: who accessed what resource at what time from which IP.
Design RBAC for {{app_type}} with {{role_count}} roles covering {{resource_types}}, and provide middleware/guard examples.
Include permission matrix documentation and a migration plan for adding new roles without breaking existing access.

Переменные

Цели экспорта

Используется в паках

Не используется ни в одном паке