Authentication is not authorization
A B2B SaaS may know exactly who a user is and still expose the wrong data if roles, memberships and resource permissions are not modelled explicitly.
1. Start from actors and business actions
List what owners, admins, managers, members, operators and external users can actually do. Roles are useful packaging; permissions describe the durable business actions.
User → Organization → Membership → Role → Permission → Resource → Action2. Keep authorization close to domain actions
Do not rely on hiding UI controls. The backend must validate the active organization, the actor permission and the resource boundary for every protected mutation and sensitive read.
3. Design for least privilege
Default roles should grant the minimum access needed. High-risk actions — payouts, ownership transfer, billing changes, document approval or exports — may need additional policy or confirmation.
4. Make changes auditable
Role assignments, permission changes and privileged actions should create audit events with actor, target, previous state, new state and timestamp.
5. Plan for enterprise evolution
Many products begin with a handful of fixed roles and later add custom roles, SSO, directory sync or fine-grained permissions. A clean membership/permission model makes that evolution possible without rewriting the domain.