How I Learned to Stop Bolting On RBAC and Actually Build It Right in MEAN Stack

I've seen this happen on more than one project. An app goes live, everything looks fine, and then — maybe a week in, maybe two — someone notices a regular user can access a route that was never meant