How did you control who could read what on your site, and what was that system called?

On our platform we implemented a fine‑grained role‑based access control (RBAC) system. Each user was assigned one or more roles (e.g., Viewer, Editor, Admin) and each role had a set of permissions that mapped to specific resources or actions. We stored the role‑permission mapping in a dedicated permissions table and used a middleware layer to intercept every read request. The middleware checked the user’s JWT token, extracted the roles, and looked up the allowed actions in the permissions table. If the action was not permitted, the request was denied with a 403 response. We called this system “Permission Matrix” in our documentation, but internally we referred to it as the “Access Control Layer.” This approach allowed us to change permissions without redeploying code, and it integrated cleanly with our audit logging to track who accessed what.