Backend & systems·Security and identity
you assign the user a role and let the role carry the permissions, instead of granting each capability one at a time.
Role-based access control
Also calledRBAC, roles
Granting permissions to roles and roles to users. It is simple to reason about and audit, and it covers most organisational needs. It struggles when permission depends on the specific record — ownership, tenancy, state — which is where people either add a role per customer or move to attribute-based rules.