Developer/Auth/RBAC-ABAC/README

RBAC ABAC

Role-based access control (fixed roles: customer/provider/admin) vs attribute-based (dynamic rules on user/resource attributes).

Why we need this / what value this brings

Without an explicit model, permission checks turn into ad hoc if user.type == 'provider' scattered through the codebase.

When to use this

RBAC is enough while roles are few and fixed (customer/provider/admin); move to ABAC once permissions depend on dynamic attributes (e.g. 'provider can edit only their own listing').

How to use or implement this

Model roles explicitly, check permissions in one central place (a policy function) rather than inline at every call site.

Research questions

Does Localz's seller/customer mode-switcher (round 2 overnight task) map cleanly to RBAC, or does it need ABAC once a user can be both?

Empty folder — drop notes, links, and findings here as you research.