Role-based access separates privileged from regular users

CMMC 2.0 AC.L1-3.1.1 and AC.L1-3.1.2 together require limiting access to authorized users and to only the functions each user is authorized to perform. Without a role separation model, every authenticated user has identical capabilities — a regular user can call admin APIs, delete other accounts, or access privileged reports. CWE-269 (Improper Privilege Management) and OWASP A01 explicitly cover flat-permission architectures where no distinction exists between standard and administrative access. In a DoD contractor context, role separation is also a condition of accountability: you must be able to prove who had what authority.

Define roles as typed constants and enforce them server-side on every privileged route. Client-side UI hiding alone does not satisfy AC.L1-3.1.2 — the check must happen in the API handler:

// lib/auth/roles.ts
export const ROLES = { ADMIN: 'admin', USER: 'user' } as const
export type Role = typeof ROLES[keyof typeof ROLES]

export function requireRole(userRole: Role | undefined, required: Role): boolean {
  if (required === ROLES.ADMIN) return userRole === ROLES.ADMIN
  return userRole !== undefined
}

// app/api/admin/users/route.ts
export async function DELETE(req: Request) {
  const session = await getServerSession()
  if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 })
  if (!requireRole(session.user.role as Role, ROLES.ADMIN)) {
    return Response.json({ error: 'Forbidden' }, { status: 403 })
  }
  // Proceed with admin action
}

Enumerate all admin endpoints and verify each has a server-side role check — role definitions in the schema that are never checked in handlers do not satisfy this practice.