I am currently building an ecommerce store, this is my first time designing authorization model its quite challenging, hard to think of all possible scenarios from the start at the start, I thought its was trivial just plug two or three roles. then noticed something that this way is static, and may not scale well !! also an idea came to my mind is to hand the users of the system the ability to create their roles, but roles are just names their must be attached to something that is fine grained and atomic -> permissions now, I am thinking, what/who kind of users are able to create roles ? and who are able of assign those roles? so there must be special permissions like : role.assign, role.create. but!! new issue sounded from the horizon . when user is able to assign roles , what limit,boundary they can assign ? can worker assign admin role to another user ? if yes then this is considered as hack ! same thing for users who can able to create roles ! can user create a role with permissions he dont have or own? so decided to : attach a boundary set of permissions for those two spicial assignments: roles are immutable except the name field. Role { id:... name:... permissions:[], create_role_scope:[], assign_role_scope: [], } for which create_role_scope,assign_role_scope both are subset or equal to permissions.