Role-Based Access Control (RBAC)
Practice this topic in a realistic system design interview
Suppose we are building an internal tool for a company with five people. Each person needs access to different features. One person can issue refunds. Another can edit products. Another can only view reports.
The simplest approach is to assign permissions directly to each user. With five users, this is easy.
But now the company grows to five thousand employees and one hundred different permissions. When a new support agent joins, someone has to remember exactly which twenty permissions support agents need. When the refund policy changes, someone has to update hundreds of users one by one. And when an employee moves to a different team, their old permissions often stay behind.
Over time, nobody can clearly answer a simple question: who can do what in this system?
Role-Based Access Control, or RBAC, solves this by grouping permissions into roles.
In this chapter, we will look at what RBAC is, how a permission check works on each request, how to design roles and permissions, and the common mistakes that make RBAC systems hard to manage.