3-tier RBAC scope: global — tenant — site — how to design it right

This post analyzes common mistakes when designing RBAC for a multi-tenant system.

Common mistakes

Mixing global and site-level permissions can accidentally grant an org admin access to sites they don't manage.

The fix

Clearly separating the three scope tiers plus delegate/self-assign flags gives precise control over who can grant what to whom.