epic-permissions

You implement RBAC permissions by defining an explicit permission model using action:entity:access formats, assigning them to roles via Prisma data models, and applying TypeScript utilities for validation across your application.

Server-side and client-side access control is enforced by applying authorization checks within API routes and using UI guards, ensuring users interact only with permitted entities based on their assigned roles.

Ownership-based access control is set up by defining permissions with 'own' for user-specific resources and 'any' for unrestricted access, then validating these scopes during server-side route checks.

You structure roles and permissions in a Prisma schema by creating models to map relationships, then use seed examples to bootstrap initial roles and explicit action:entity:access permissions for validation.

Yes, this authorization approach supports both environments by providing TypeScript utilities for server-side API route validation and specific patterns for implementing client-side UI component guards.

You should use explicit RBAC instead of basic role checks when your application requires precise ownership-based access control and granular action:entity:access permission validation across both server and client layers.