Role and Resource Access System

Design an access-control system that supports both role-based and resource-based permissions. The expected direction is a flexible policy model rather than only fixed user-to-role mappings. Requirements Support role-based access control. Support resource-based access rules. Let administrators define, attach, update, and remove permissions. Evaluate whether a user can perform an action on a resource. Discuss API design and data model for policies, roles, users, resources, and bindings. Notes A strong answer should support flexible policy composition similar to managed-policy systems: reusable permissions, resource-scoped grants, and clear conflict rules. Clarify inheritance, deny-vs-allow precedence, audit logging, and how policy changes propagate. Preparation Draft schemas for users, roles, resources, permissions, and policy bindings. Walk through examples: project admin, document owner, inherited team access, and explicit deny.