RBAC implemented with least privilege

Without role-based access control, every authenticated user has the same permissions as an administrator — a regular user can delete records, reassign roles, or exfiltrate all data through unguarded API endpoints. NIST 800-53 rev5 AC-2 (Account Management) requires formal role definitions, and AC-6 (Least Privilege) mandates that users receive only the minimum access required for their function. CWE-285 (Improper Authorization) and OWASP A01 (Broken Access Control) consistently rank this as the most exploited web application vulnerability. Frontend-only role gates are bypassed by any direct API call using the browser's developer tools.

Define roles and permissions in a central module, then enforce them in every sensitive API handler — never on the client alone.

// lib/rbac.ts
export const PERMISSIONS = {
  admin:   ['read', 'write', 'delete', 'manage_users'],
  auditor: ['read', 'write'],
  viewer:  ['read']
} as const

export function requirePermission(
  userRole: keyof typeof PERMISSIONS,
  action: string
) {
  if (!PERMISSIONS[userRole]?.includes(action)) {
    throw new Response(null, { status: 403 })
  }
}

// app/api/admin/users/route.ts
export const DELETE = async (req: Request) => {
  const session = await getServerSession()
  requirePermission(session.user.role, 'manage_users')
  // ... proceed
}

Log every role assignment and escalation event per NIST AU-2 requirements. Run permission checks in src/middleware.ts for route-level protection in addition to handler-level checks.