What is Role-Based Access Control (RBAC)?

You define a set of roles (e.g., admin, manager, member, viewer) and assign permissions to each role (e.g., admin can delete users, member can edit own profile). When a user makes a request, the system checks their role's permissions to determine if the action is allowed. Users are assigned roles, and role definitions are managed centrally.

AI-generated apps typically have a binary model: logged in or not. Real applications need granular access control — team members need different permissions than admins, free users need different access than paid users. Implementing RBAC properly from the start saves painful refactoring later when you inevitably need role-based features.

Hardcoding role checks throughout the codebase (making changes painful), not checking roles on the server side, having too many granular roles (complexity explosion), roles that accumulate permissions over time without cleanup, and not handling role changes in active sessions.

Define roles based on business needs, not technical ones. Centralize authorization logic in middleware or a policy layer. Keep the number of roles manageable (start with 3–5). Apply least privilege — start with minimal permissions and add as needed. Test authorization by attempting restricted actions as each role. Use a library like CASL or casbin for complex permission logic.