RBAC does not replace tenant isolation_

Roles answer what a user may do. Tenant isolation answers whose data the action may touch. A SaaS platform needs both checks in the same request path.

A global `admin` string, a client-supplied tenant ID, or a missing row filter can turn legitimate features into cross-customer access.

What changes in practice_

Bind identity to tenant membership, evaluate role and resource ownership server-side, and treat super-admin impersonation as a separately audited capability.

• Scope queries by trusted tenant context.
• Audit impersonation start and end.
• Test role changes and revoked membership.

Our take_

The durable advantage is not adopting the newest tool first. It is building the identity, state, evidence, and operating boundaries that let a real team own the system after launch.