rbac

name	rbac
description	Role-based access control — roles, permissions, policies, middleware guards, database schema, and authorization patterns for web applications
layer	utility
category	security
triggers	["rbac","role based access","permissions","authorization","access control","admin role","user roles","middleware guard","permission check"]
inputs	["Application role hierarchy","Resource types and actions","Current auth system (session, JWT, etc.)","Framework (Next.js, Express, etc.)"]
outputs	["RBAC database schema","Permission checking middleware/guards","Role assignment API","UI permission gating components","Policy evaluation engine"]
linksTo	["authentication","better-auth","api-designer","database-indexing"]
linkedFrom	["owasp","security-scanner"]
preferredNextSkills	["authentication","owasp"]
fallbackSkills	["api-designer"]
riskLevel	high
memoryReadPolicy	always
memoryWritePolicy	selective
sideEffects	["Creates database tables and relationships","Adds middleware to request pipeline","May block user access if misconfigured"]

RBAC (Role-Based Access Control) Skill

Purpose

Authorization determines what authenticated users can do. RBAC maps users to roles, roles to permissions, and permissions to resource actions. This skill covers schema design, middleware implementation, UI gating, and common authorization patterns.

Key Concepts

RBAC Model

User  ──M:N──  Role  ──M:N──  Permission
                                   │
                              Action + Resource
                              ("create:post", "delete:user")

Permission Granularity Levels

Level	Example	Complexity	Use When
Role-only	isAdmin	Low	Small apps, 2-3 roles
Role + Permission	admin has users:delete	Medium	Most apps
ABAC (Attribute-based)	can delete IF owner OR admin	High	Multi-tenant, fine-grained
ReBAC (Relationship-based)	can edit IF member of org	High	Google Docs-style sharing

Decision Framework

How many roles? (2-5)
  └─ Role-only checks are sufficient

Do different roles need different actions on same resource?
  └─ Role + Permission model

Do permissions depend on data relationships (ownership, team membership)?
  └─ ABAC or ReBAC (consider Oso, Cerbos, or OpenFGA)

Workflow

Step 1: Database Schema

-- Core RBAC tables
CREATE TABLE roles (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  name VARCHAR(50) UNIQUE NOT NULL,      -- 'admin', 'editor', 'viewer'
  description TEXT,
  is_system BOOLEAN DEFAULT false,        -- Prevent deletion of built-in roles
  created_at TIMESTAMPTZ  now()
);

 permissions (
  id UUID   gen_random_uuid(),
  action () ,            
  resource () ,         
  description TEXT,
   (action, resource)
);

 role_permissions (
  role_id UUID  roles(id)   CASCADE,
  permission_id UUID  permissions(id)   CASCADE,
   (role_id, permission_id)
);

 user_roles (
  user_id UUID  users(id)   CASCADE,
  role_id UUID  roles(id)   CASCADE,
  assigned_at TIMESTAMPTZ  now(),
  assigned_by UUID  users(id),
   (user_id, role_id)
);


 INDEX idx_user_roles_user  user_roles (user_id);
 INDEX idx_role_permissions_role  role_permissions (role_id);


 roles (name, description, is_system) 
  (, , ),
  (, , ),
  (, , );


 permissions (action, resource) 
  (, ), (, ), (, ), (, ),
  (, ), (, ), (, ), (, ),
  (, ), (, ), (, );



 role_permissions (role_id, permission_id)
 r.id, p.id  roles r   permissions p  r.name  ;


 role_permissions (role_id, permission_id)
 r.id, p.id  roles r, permissions p
 r.name  
   ((p.resource  )  (p.action    p.resource  ));


 role_permissions (role_id, permission_id)
 r.id, p.id  roles r, permissions p
 r.name    p.action  ;