Why should you care?

Regulations require least privilege — tellers must not export all customer PII.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

const PERMISSIONS = {
  admin: ['accounts:read', 'accounts:write', 'users:manage'],
  teller: ['accounts:read', 'transfers:create'],
  analyst: ['reports:read']
} as const;

export function requirePermission(perm: string) {
  return (req: Request, res: Response, next: NextFunction) => {
    const roles: string[] = req.user?.roles ?? [];
    const allowed = roles.some(r => PERMISSIONS[r as keyof typeof PERMISSIONS]?.includes(perm));
    if (!allowed) return res.status(403).json({ message: 'Insufficient permission' });
    next();
  };
}

router.post('/transfers', auth, requirePermission('transfers:create'), createTransfer);

What happened?

• Roles map to permission strings.
• Middleware checks union of user's roles.
• Route declares required permission explicitly.

Practice next

1. Define role-permission matrix document.
2. Store roles array in JWT or load from DB per request.
3. Apply requirePermission on sensitive routes.
4. Add attribute-based check: owner can read own account only.
5. Store permissions in MongoDB for dynamic admin UI.

Remember

RBAC = roles bundle permissions. Enforce on Express always. Align Angular guards with same permission names.

Healthcare records

Nurse reads assigned patients; billing clerk reads invoices only.

Outcome: 403 on API prevents horizontal privilege escalation.