Notes from the work.

Backend

RBAC is not enough: roles, permissions, and scopes

A practical model for authorization that separates what someone can do from exactly where they are allowed to do it.