Tell us about the role model in your projects. How did you describe access restrictions?

In projects, the access role model is usually built based on the RBAC (Role-Based Access Control) principle. For each user type (role), a set of permissions is defined — what they can view, modify, create, or delete.

Access restrictions are described through:

• Roles — for example, administrator, manager, user.
• Permissions — operations available in the system (read, write, delete).
• Role and permission relationships — each role aggregates a specific set of permissions.

In technical implementation, this could be a configuration file, a database with role and permission tables, or built-in framework mechanisms (e.g., Spring Security). In the UI and API, it was checked whether the current user has the necessary role to perform an action.

Example: The "Manager" role has permissions to view and edit orders but not to manage users. When attempting to call the API to manage users, the system returns an access error.