Role-based access control (RBAC) is documented and enforced

PCI-DSS 4.0 Req 7.1 requires a formal model where access to system components is restricted on a need-to-know basis; Req 7.2 mandates that the access control model documents each user's required access level. Without RBAC, every authenticated user is implicitly authorized to access all data — a customer account can query transaction records for other customers, or a support agent can issue refunds. CWE-285 (Improper Authorization) and OWASP A01 (Broken Access Control) are the most exploited vulnerability class across web applications. NIST AC-2 requires that accounts are managed with assigned access rights enforced in code.

Define roles in a docs/rbac.md permissions matrix (minimum: admin, merchant, customer), then enforce them in middleware — not inline in each handler. Create a requireRole() helper in src/middleware/auth.ts that returns 403 before any business logic runs.

// src/middleware/auth.ts
export async function requireRole(supabase, requiredRoles: string[]) {
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) return new Response('Unauthorized', { status: 401 });
  const { data } = await supabase.from('user_profiles')
    .select('role').eq('user_id', user.id).single();
  if (!requiredRoles.includes(data.role))
    return new Response('Forbidden', { status: 403 });
  return null;
}

Apply it at the top of every API route that touches CDE data before any database query executes.