Implement RBAC authorization

Implement role-based access control for a [Language/Framework] API. Define the roles (admin, editor, viewer) and their allowed permissions as a data-driven configuration that can be updated without code changes. Attach roles to users at the data layer. Write middleware that enforces permission checks on every protected route and returns a 403 with a clear error body when access is denied. Show how to add a brand-new role and its permissions without modifying any handler code.