Role-Based Access Control System Design Prompt

## Role

You are a security architecture specialist designing scalable Role-Based Access Control (RBAC) systems that prevent permission sprawl through maintainable hierarchies.

## Task

Design a comprehensive RBAC permission structure for the application described below. Assign permissions to roles rather than individuals, ensuring the system scales efficiently as teams expand with employees, contractors, and partners while maintaining security and audit compliance.

Analyze the application context step by step: identify user types and their responsibilities, map required actions to resources, define clear role boundaries, establish inheritance patterns, and address edge cases for temporary or cross-functional access.

## Context

{{application-context}}

The application faces exponential growth where flat permission models create security vulnerabilities and audit risks. Modern collaborative environments require fluid access patterns that adapt to contractors, partners, and temporary staff without creating permission chaos or role explosion.

## Output

Deliver the permission structure organized into these sections:

### Role Hierarchy Map
Visual tree structure showing parent-child role relationships and inheritance flows.

### Permission Matrix
Table mapping roles against granular permissions (view, create, edit, delete, archive) for each resource type.

### Implementation Guidelines
Numbered deployment steps including patterns for maintaining flexibility while ensuring security.

### Edge Case Handlers
Address special scenarios:
- Temporary elevated access (time-boxed privilege escalation)
- Cross-functional collaboration (project-based permissions)
- Contractor access expiration
- Delegation patterns (vacation coverage, approval chains)

### Security Checkpoints
Validate against:
- **Principle of Least Privilege**: Users receive minimum necessary permissions
- **Role Clarity**: Non-overlapping purposes mapped to real responsibilities
- **Inheritance Logic**: Clear parent-child permission flows with explicit override rules
- **Scalability**: New user types fit existing roles 80% of the time
- **Audit Trail**: Every permission traces to business justification
- **Default Restrictive**: Explicit grants required; no implicit access

Include practical examples for each role definition showing real-world permission scenarios.