Designing Enterprise RBAC & ABAC Systems: Hierarchical Roles, Permission Matrices, and Middleware Enforcement

Managing authorization across multi-tenant enterprise portals requires robust Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). Hardcoding permission checks leads to security vulnerabilities and codebase fragmentation. Implementing a centralized permission matrix ensures strict authorization across API routes and UI components.

1. Relational RBAC Database Schema

A resilient authorization model relies on normalized relational tables connecting Users, Roles, Permissions, and Resource Entities:

type Action = "create" | "read" | "update" | "delete" | "manage";
type Subject = "Vendor" | "Lead" | "User" | "Review" | "all";

interface Permission {
  action: Action;
  subject: Subject;
  conditions?: Record<string, any>; // ABAC Attribute Condition
}

function canUserPerform(userRole: string, action: Action, subject: Subject): boolean {
  const rolePermissions: Record<string, Permission[]> = {
    superadmin: [{ action: "manage", subject: "all" }],
    editor: [
      { action: "read", subject: "Vendor" },
      { action: "update", subject: "Vendor" }
    ],
    client: [{ action: "read", subject: "Vendor" }]
  };

  const allowed = rolePermissions[userRole] || [];
  return allowed.some(
    (p) => (p.action === action || p.action === "manage") && (p.subject === subject || p.subject === "all")
  );
}

2. Next.js 16 Edge Proxy & JWT Claim Enforcement

By embedding encrypted role claims directly into session JWTs, Edge Proxy middleware verifies user permissions in sub-5ms before requests hit backend application servers, mitigating unauthorized data leaks.