Role-based access control

Role-based access control grants permissions to roles rather than to individuals, and assigns people to roles. An accountant inherits what accountants may do; changing what the role permits changes it for everyone in it at once.

The benefit over per-person permissions is that entitlements stay reviewable. It is possible to answer "who can issue refunds" by reading the role, rather than by auditing every account and finding the three exceptions somebody granted in a hurry.

The failure mode is role sprawl, where exceptions accumulate until there are nearly as many roles as people and the model has quietly become per-person permissions with extra steps. Periodic review is part of the design, not an afterthought.