Role-based access control (RBAC) is an approach to restricting system access to users based on defined roles. Many companies have built internal system like these, but usually in a very archaic and haphazard way.
There are a few primary semantics to a role and a set of attributes, operaters, and actions that define a role.
A role should have five semantic components:
A policy has one primary component:
A statements has three components:
{"effect": "deny","resources": ["prod/primaryDB/*"],"actions": ["deleteDB"]}
You should be able to assign multiple roles to an individual user. Ideally, you would have a clear user interface that allows you to build these roles and attach them to individual users or groups of users.
It is very common amongst large companies to accrue hundreds or thousands of roles over time. Having an intuitive GUI lets you manage this debt, keep your roles up-to-date, and keep your system secure.