User Roles: Implement a Role-Based Access Control System with Permission Inheritance

Question

## Problem

Build a `RBACSystem` class. Users are assigned roles. Roles have permissions. A user's effective permissions are the union of permissions from all their roles.

```python
class RBACSystem:
    def add_role(self, role: str, permissions: list) -> None: ...
    def assign_role(self, user_id: str, role: str) -> None: ...
    def has_permission(self, user_id: str, permission: str) -> bool: ...
    def get_permissions(self, user_id: str) -> set: ...
    def revoke_role(self, user_id: str, role: str) -> None: ...
```

**Example:**
```
rbac = RBACSystem()
rbac.add_role("editor", ["read", "write"])
rbac.add_role("publisher", ["read", "publish"])
rbac.assign_role("alice", "editor")
rbac.assign_role("alice", "publisher")

rbac.get_permissions("alice")       -> {"read", "write", "publish"}
rbac.has_permission("alice", "delete") -> False

rbac.revoke_role("alice", "editor")
rbac.get_permissions("alice")       -> {"read", "publish"}
```

## Follow-ups

1. How would you add role hierarchy so a "super_editor" role inherits all "editor" permissions plus extras?
2. What is the difference between RBAC and ABAC, and when would you choose each?
3. How would you audit all permission checks — which user, which permission, at what time, and whether it was granted?
4. How do you handle the case where the same permission exists in two roles but one role is later modified to remove it?

User Roles: Implement a Role-Based Access Control System with Permission Inheritance

Question Details

Full Details

Topics

More from Stripe