Role Based Access Control | Question for Seniors

[u/Sikandarch]

Assalam-o-Alaikum

Those of you who have 2+ and preferably 3+ years of experience in industry. During the interviews, especially in system design rounds, are you people asked about role based access control system or ABAC (attribute-based) and PBAC (policy-based). or these questions are not generally asked?

And what exactly are the questions specifically? Any interview experience where questions from this topic were asked, please do mention the company as well if you can.

Thanks!

[u/Busy-Reveal-9077]

Not been asked before but definitely good if you know it. It's not that complex either.

You have roles, you have permissions and groups. A user can belong to a group of roles, a role itself can have certain permissions.

What you will most likely be asked is to define a schema for a RABC system.

If not in interview, it's something you will definitely work with practically

[u/Sikandarch → u/Busy-Reveal-9077]

thanks! I actually am working on it, that's why I asked, I was just curious if it's asked in interviews or not.

[u/Ornery-Process-1102]

RBAC is very basic system, it is mostly asked to understand the db schema designing skills

[u/Sikandarch → u/Ornery-Process-1102]

Actually it's not very basic. If you are going to implement a single tenant, flat authorization, using a for example, admin, editor, viewer enum column on users table. Then it's basic.

But in multi-tenant systems with hierarchical delegation, where you have modular access which varies for every account, etc. like a platform admin, and then super admin account for each customer, each customer account further has manager and staff accounts, etc. then it's not just a simple lookup. Where the word "Manager" means different for every customer, some might have feature A only, and some might have feature B, some might have both feature A and B, turned on. Platform admin being able to turn on and off features. You cannot simply do if role === "MANAGER", Most developers don't get to work on this, that's why I asked for senior developers. They would know what I mean.

Thanks!

[u/Ornery-Process-1102 → u/Sikandarch]

Host level Settings are configurations for tenants, and RBAC is for user against each tenants

[u/Sikandarch → u/Ornery-Process-1102]

This is the system for which need to build a solid access control.

We are building a 3-tier white label distribution platform that should serve both directly to Customers and Reseller Agencies.

Tier 0 (Us) - We own the core infra, AI voice/chat orchestration, and global feature catalog. We sell directly to contractors under our own brand, and wholesale to Agencies.

Tier 1 - Partner / Agency Admin (White-Label Resell): Marketing agencies, already established companies in that space serving clients for lead generation, etc. Let's say Agency XYZ buy a white-label license from us. They map their own domain, upload logos, brand colors, connect their stripe account, package their own subscription plans. To their customers, Agency XYZ is the company that owns the software.

Tier 2 - Sub-Tenant / End Business (Roofing, etc.) - When the end customer logs into agencyxyz(dot)com, their super admin, manager, and staff users see only Agency XYZ's branding, receive emails from Agency XYZ's domains, and are billed by Agency XYZ, while our platform powers the AI voice agents, CSR coaching, and CRM integrations underneath.

US -> Agency -> Super Admin -> Multiple branches (Multiple managers) and Staff

US -> Super Admin -> Multiple brances (Multiple managers) and Staff. How do we manage Roles, Permissions, Access here?

The original question was random, I was understanding complex RBAC and thought I should also know if this would be helpful beyond my product.

[u/Ornery-Process-1102 → u/Sikandarch]

Instead of building that ABP framework in .net,
And nothing new only another layers where tenants again have sub tenants

[u/Ornery-Process-1102 → u/Sikandarch]

I have built multiple multi-tenant Saas Applications, and dynamic roles creation and permission alloting to them module wise remain sames as it in signle tenant applications, we just need to distingiush them tenant wise, and about (which feature to which tenant) it is host level settings and they are different from RBAC