Roles → permissions → resources (screens and features). Least privilege, hierarchy and separation of duties.