Access Control Design

Design and implement access control systems for applications of any size. Covers RBAC, ABAC, ACL, and hybrid models with database schemas, middleware patterns, and permission management UIs.

Usage

Describe your application's user types, resources, and permission requirements. The designer recommends an access control model and provides implementation guidance including database schema and authorization logic.

Parameters

• Model: RBAC (Role-Based), ABAC (Attribute-Based), ACL (Access Control List), or Hybrid
• Scale: Simple (3-5 roles), Medium (teams/organizations), or Complex (multi-tenant)
• Platform: Node.js, Python, Java, or Cloud IAM
• Requirements: Basic permissions, Hierarchical roles, Resource-level, or Dynamic policies

Examples

1. SaaS Multi-Tenant RBAC: Design role hierarchy for a B2B SaaS — organization owner, admin, member, viewer roles with resource-scoped permissions and cross-tenant isolation.

1. Healthcare ABAC: Attribute-based access control for a medical records system — access decisions based on user role, department, patient relationship, data sensitivity, and time of access.

1. API Authorization Middleware: Implement permission-checking middleware for an Express/Next.js API with role verification, resource ownership checks, and rate limiting per permission level.

1. Admin Permission Management UI: Design the interface for managing roles and permissions — role creation, permission assignment, user-role mapping, and audit log viewing.

Guidelines

• Access control model is selected based on complexity needs (RBAC for most, ABAC for complex)
• Database schemas efficiently store roles, permissions, and assignments without N+1 queries
• Permission checks happen server-side — client-side checks are for UX only, never security
• The principle of least privilege is applied: users get minimum permissions needed
• Permission inheritance in role hierarchies is clearly defined (admin inherits member permissions)
• Resource-level permissions handle "user can edit THEIR posts but not others'"
• Denial takes precedence over grants when permissions conflict
• Audit logging records who accessed what, when, and whether it was allowed or denied
• Permission caching strategies balance performance with consistency after permission changes
• Migration patterns handle adding new permissions to existing roles without breaking access