--- title: Day 13/30 — Roles Are Not Enough | daily.dev description: Basic role-based access control (RBAC) with 'Admin' and 'User' roles breaks down when real business questions arise — like whether a finance manager can refund... canonical: https://daily.dev/posts/day-13-30-roles-are-not-enough-yko288k8n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Day 13/30 — Roles Are Not Enough | daily.dev og:description: Basic role-based access control (RBAC) with 'Admin' and 'User' roles breaks down when real business questions arise — like whether a finance manager can refund... og:url: https://daily.dev/posts/day-13-30-roles-are-not-enough-yko288k8n og:image: https://api.daily.dev/og/posts/yKO288k8n.png og:image:alt: Day 13/30 — Roles Are Not Enough og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Day 13/30 — Roles Are Not Enough **[Nestjs Developers](https://daily.dev/sources/nestjsdevs)** · [@ezilemdodana](https://daily.dev/ezilemdodana) · 1 min read · 69 upvotes · 12 comments ## Summary Basic role-based access control (RBAC) with 'Admin' and 'User' roles breaks down when real business questions arise — like whether a finance manager can refund an invoice or an author can only edit their own draft. A stronger authorization model evaluates actor + action + resource + context together, rather than scattering role checks across controllers and services. ## Content “Admin” and “User” work until the business asks a real question. Can a finance manager refund this invoice? Can a tenant administrator edit users from another tenant? Can an author update only their own draft? Roles describe broad identity. Permissions and policies describe actions on resources within a context. A stronger model checks: actor + action + resource + context Avoid scattering `user.role === ...` checks throughout controllers and services. When did your application outgrow basic role-based access control? #NestJS #RBAC #ApplicationSecurity ## Community discussion Top comments from developers on daily.dev. **@zedler** · 12 upvotes > Absolutely. You cannot build a broader enterprise system using just roles and permissions. > > Real world business scenarios quickly go beyond basic RBAC. When the authorization model cannot express those scenarios, the result is usually hardcoded role checks scattered throughout the application. > > At a high level, **RBAC answers: “What is this role allowed to do?”** including CRUD and other business operations. > > But then comes a more important dimension: **the data**. > > What _subset_ of the data is this user allowed to CRUD? > > And then there is another dimension: **the relationship**. > > Is this... **@etiene** · 1 upvotes > In my opinion, how you design a system, depends largely on it's requirements. **@agustinbarrientos** · 1 upvotes > Resource ownership belongs in a policy check, not another role with a longer name **@mikhailmakeev** · 1 upvotes > For us the axis wasn't the role, it was the credential. One auth config accepts both a browser session JWT and a developer API key, so the same user identity arrives two ways and only one of them may rotate a key or start a checkout. That check sits in a permission class on 11 view modules, and forgetting it on a new mutation endpoint turns a leaked read-only key into account takeover. **@luisferfranco** · 0 upvotes > Wel... duh! ## Similar posts on daily.dev - [What Is Role-Based Access Control \(RBAC\)?](https://daily.dev/posts/what-is-role-based-access-control-rbac--ofppjlkdu) · Nordic APIs · 0 upvotes · 0 comments - [Designing a Role Based Access Control System for a Multi Company SaaS Platform](https://daily.dev/posts/designing-a-role-based-access-control-system-for-a-multi-company-saas-platform-yr5wenw3h) · Medium · 0 upvotes · 0 comments - [Stop Checking admin?: Designing Authorization That Won’t Become Technical Debt \(Kaigi on Rails 2025\)](https://daily.dev/posts/stop-checking-admin-designing-authorization-that-won-t-become-technical-debt-kaigi-on-rails-2025--uby4bj1ii) · Ruby Flow · 0 upvotes · 0 comments - [Basic role management](https://daily.dev/posts/basic-role-management-1oebggcue) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#appsec](https://daily.dev/tags/appsec), [#authorization](https://daily.dev/tags/authorization), [#nestjs](https://daily.dev/tags/nestjs) [View this post on daily.dev](https://daily.dev/posts/day-13-30-roles-are-not-enough-yko288k8n) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/day-13-30-roles-are-not-enough-yko288k8n","headline":"Day 13/30 — Roles Are Not Enough","text":"Basic role-based access control (RBAC) with 'Admin' and 'User' roles breaks down when real business questions arise — like whether a finance manager can refund an invoice or an author can only edit their own draft. A stronger authorization model evaluates actor + action + resource + context together, rather than scattering role checks across controllers and services.","url":"https://daily.dev/posts/day-13-30-roles-are-not-enough-yko288k8n","datePublished":"2026-08-11T12:21:49.488Z","dateModified":"2026-09-13T21:32:13.246Z","author":{"@type":"Person","name":"Ezile Mdodana","url":"https://daily.dev/ezilemdodana","image":"https://media.daily.dev/image/upload/s--1OI8gwnO--/f_auto/v1771923757/avatars/avatar_7vB9SeLRKhOHGnzEpmFvQ?_a=BAMAMiiu0","description":"Software Project Lead sharing practical insights on NestJS, Angular, AWS and scalable systems.","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":8430}},"image":"https://media.daily.dev/image/upload/s--6ayaPHOi--/f_auto/v1786450910/posts/yKO288k8n?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":69},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":12}],"comment":[{"@type":"Comment","text":"Absolutely. You cannot build a broader enterprise system using just roles and permissions.\nReal world business scenarios quickly go beyond basic RBAC. When the authorization model cannot express those scenarios, the result is usually hardcoded role checks scattered throughout the application.\nAt a high level, RBAC answers: “What is this role allowed to do?” including CRUD and other business operations.\nBut then comes a more important dimension: the data.\nWhat subset of the data is this user allowed to CRUD?\nAnd then there is another dimension: the relationship.\nIs this user allowed to perform an action because they own the resource, manage the resource, belong to the same organization, or have some other relationship with it?\nSo, in practice, enterprise authorization often needs a combination of:\n\nRBAC — Role-Based Access Control\nABAC — Attribute-Based Access Control\nReBAC — Relationship-Based Access Control\n\nThe real authorization decision becomes much closer to:\nActor + Action + Resource + Context + Relationship\nThat is where simple user.role === ... checks start breaking down—and where a proper authorization model becomes essential.","datePublished":"2026-08-11T14:04:39.570Z","url":"https://daily.dev/posts/yKO288k8n#c-1cvApemtE","author":{"@type":"Person","name":"Prince Mathew","url":"https://daily.dev/zedler","image":"https://lh3.googleusercontent.com/a/ALm5wu3i5Iil3hpVfZVU-5FSDVlAZt7-EHYI5n-gymXGgg=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":12}},{"@type":"Comment","text":"In my opinion, how you design a system, depends largely on it’s requirements.","datePublished":"2026-08-12T03:35:25.974Z","url":"https://daily.dev/posts/yKO288k8n#c-QfDLqvsUC","author":{"@type":"Person","name":"Etiene James","url":"https://daily.dev/etiene","image":"https://media.daily.dev/image/upload/v1675164890/avatars/avatar_yp08BYiIBvg8bT1Q0D2ZC.jpg"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Resource ownership belongs in a policy check, not another role with a longer name","datePublished":"2026-08-12T00:06:24.314Z","url":"https://daily.dev/posts/yKO288k8n#c-i0gQQU34x","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"For us the axis wasn’t the role, it was the credential. One auth config accepts both a browser session JWT and a developer API key, so the same user identity arrives two ways and only one of them may rotate a key or start a checkout. That check sits in a permission class on 11 view modules, and forgetting it on a new mutation endpoint turns a leaked read-only key into account takeover.","datePublished":"2026-08-12T14:15:19.528Z","url":"https://daily.dev/posts/yKO288k8n#c-j40a2PYQZ","author":{"@type":"Person","name":"Mikhail Makeev","url":"https://daily.dev/mikhailmakeev","image":"https://lh3.googleusercontent.com/a/ACg8ocIjcvDU1gmJ9-KJDeTYqY2rMdl5QxcWYtLTGSXrj8ubF4nwar_w=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Wel… duh!","datePublished":"2026-08-14T20:48:26.210Z","url":"https://daily.dev/posts/yKO288k8n#c-tD12XRQsm","author":{"@type":"Person","name":"Luis Fernando Franco","url":"https://daily.dev/luisferfranco","image":"https://lh3.googleusercontent.com/a/ACg8ocIirc3tzfK4ibqy5WFRNJzf9yw6VXiTrCrhi4Ogsjf3EcCzQEv-=s96-c"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/nestjsdevs","name":"Nestjs Developers"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Nestjs Developers","item":"https://daily.dev/squads/nestjsdevs"},{"@type":"ListItem","position":3,"name":"Day 13/30 — Roles Are Not Enough"}]} ```