RBAC Without the Pain: 58 Atomic Permissions in Production
In PDP, we built an RBAC model that doesn’t fall apart as soon as someone asks, “Can he do this too?” The setup uses 58 atomic permissions, object-level access, and multi-role support so permissions in production don’t turn into permission spaghetti.
In PDP, we built an RBAC model that doesn’t fall apart the first time someone says, “Can he do this too?” The foundation is {entity}_{can_view|can_create|can_edit|can_delete}, for a total of 58 atomic permissions.
But the main challenge wasn’t the number of permissions — it was object-level access: a user only sees the buildings and spaces they’re actually linked to. Otherwise you get the usual mess — a site foreman suddenly looking at deals, or a sales manager digging into inspectors’ notes. Not great.
The fun part was multi-role support. In real life, the same person can be an inspector, the person responsible for a note, and an observer at the same time. At that point, “one role = one access level” doesn’t cut it; you need a careful calculation of permission intersections.
So in short, we built a system that’s much closer to real construction work than to an IAM textbook. Given the trend toward fine-grained access control, it’s basically a must if you don’t want to end up with permission spaghetti in production.