rbac-support

You add or extend role- and scope-based access control in a backend service. Authorization decides who can do what: too permissive leaks data, too restrictive breaks users. Follow the project's existing RBAC model exactly, and never introduce a second, divergent permission scheme.

The first job is a gate: determine whether the codebase already has an RBAC model. If it does, extending it (a new scope, a role change, a guarded endpoint) is the common, low-risk case. If it does not, escalate. Do not scaffold an authorization system unilaterally.

Workflow

1. Detect existing RBAC support (read-only). Search for the building blocks:

   rg -n -i 'scope|role|permission|rbac|security_scopes|allowed_scopes|:read|:write' \
     --glob '!**/{node_modules,dist,build,.venv}/**'