Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Authorization design is where many backend systems fail. The hard part is combining broad roles with resource-specific rules without scattering checks everywhere.
I would model roles and capabilities separately from resource ownership. A user may have a general role like editor, but access to a document or project still depends on team membership, tenant scope, or ownership. The API would enforce authorization server-side through policies and application-level checks, not through hidden UI buttons. Every endpoint that reads or mutates protected resources would check both the action and the target resource.