Role-Based Access Control

RBAC defines permissions on roles — storekeeper, buyer, approver, accountant — and assigns people to roles. Access changes with the job rather than through one-off adjustments to individual accounts.

It makes access reviewable. Asking "who can approve a payment" is answerable in seconds, and a leaver loses everything at once instead of retaining access nobody remembers granting.