A Practical Specification for Roles, Permissions, and Policy Decisions

The full specification is available here: Authorization Model Specification. Authorization logic often starts simple. At first, a role like admin, editor, or viewer is enough. Then the product grows.