Use when requests involve RBAC, authorization rules, admin features, resource access control, permission modeling, or separating identity from what authenticated users are actually allowed to do. Design and enforce role-based access control and permission models for applications: roles, permissions, scopes, tenancy boundaries, policy checks, privileged actions, and authorization review.
