A hundred-plus guarded routes, multi-role aggregation and a two-tier cache — built rather than bought, so the access model stayed ours.
The ERP needed real role-based access across more than a hundred routes, with people holding several roles at once and inheriting the union of them. Off-the-shelf identity products do this well and would have shipped sooner.
The catch was where the model would live. Buy it, and our access model lives in someone else's schema — which means every future module has to be expressible in their vocabulary, every migration waits on their roadmap, and the cost of leaving grows with every route we add.
It was the faster plan and on a normal week it would have been the right one. I killed it because the access model is not a feature, it is the shape every other feature has to fit into. Renting that shape means every module we had not designed yet would have to negotiate with a vendor's idea of a role.
An in-memory Map in front of Redis on a five-minute TTL. Permissions change rarely and are read constantly, which is the exact shape a cache is for. Without it, correct authorisation would have made every endpoint measurably slower, and someone would eventually have proposed skipping it on the fast routes.
A PermissionGuard component gates the UI against the same Module → SubModule → Action tree the API enforces. Two separate definitions would have drifted within a quarter, and the drift always resolves the same way — a button that exists for a user who is not allowed to press it.
Two roles granting overlapping subtrees needed a defined merge, and most-permissive-wins has sharp edges when one role exists specifically to restrict.
A five-minute TTL means a revoked permission can survive five minutes. Acceptable for additions, not for revocations — those needed an explicit bust rather than waiting for expiry.
Build the thing that defines the shape of everything else. Buy the things that fit into it.
An authorisation check that is slow will eventually be skipped by someone under deadline. Make it free instead of making it a rule.
If the UI and the API disagree about permissions, the UI is lying to the user. One source of truth or none.