I do authentication in terms of operations a.k.a. claims a.k.a. attributes, such as &quot;Can Create User&quot;.<p>These are simple, easy to understand, and provide good flexibility.<p>If you enjoy using roles that&#x27;s fine too: for example you can create an &quot;Admin&quot; role that grants permissions to do many operations. In other words the Admin role has many claims.<p>In your authorization code, you check the operation, not the user nor the role.<p>In your database or ORM, you can create these tables: users, users-roles, roles, roles-operations, operations.<p>We have a detailed writeup here: <a href="https:&#x2F;&#x2F;github.com&#x2F;SixArm&#x2F;sixarm_ruby_rbac" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;SixArm&#x2F;sixarm_ruby_rbac</a>