Permissions and Access Control System Template

For most SaaS products, RBAC (role-based access control) is the right starting point. It is simple to reason about, easy for admins to manage, and covers 90% of access control needs. ABAC (attribute-based access control) adds flexibility by evaluating conditions like "user's department," "document's sensitivity label," or "time of day." Consider ABAC when you need fine-grained, context-dependent policies (common in healthcare, finance, and government). A hybrid approach works too: RBAC for the base model with ABAC rules for specific high-sensitivity resources.

Three to five for most B2B SaaS products. A common set is Owner, Admin, Member (Editor), and Viewer. Add Guest if you support external collaboration. Adding more roles increases complexity for admins and testing burden for engineering. If customers request custom roles, consider offering that as an Enterprise feature where they define their own permission sets using your RBAC primitives.

Both. Always enforce at the API layer. UI-only enforcement (hiding buttons) is trivially bypassed. The API should return 403 Forbidden for unauthorized actions. The UI should then reflect the API's permission model by hiding or disabling controls the user cannot use. This prevents confusion and accidental 403 errors.

Separate ownership from access. The content creator is always the "owner" metadata (for audit purposes), but their access follows their current role. If an Editor is downgraded to Viewer, they can still see their own content but cannot edit it. If a user is removed entirely, transfer their content ownership to their manager or the workspace Owner. Never delete content when removing a user.

At minimum: user authentication events (login, logout, failed attempts), permission changes (role assignments, access grants/revocations), data access events (exports, downloads), and administrative changes (settings, billing, integrations). Log retention should be at least 90 days. The audit log itself must be tamper-proof (append-only, no edit or delete capabilities for any user including Owners). ---